diff --git a/openair2/COMMON/ngap_messages_types.h b/openair2/COMMON/ngap_messages_types.h
index 2c4b0f8a0a..5be5e316ef 100644
--- a/openair2/COMMON/ngap_messages_types.h
+++ b/openair2/COMMON/ngap_messages_types.h
@@ -421,6 +421,8 @@ typedef struct ngap_nas_first_req_s {
   /* PLMN: Selected PLMN Identity (optional)
    * User Location Information (mandatory) */
   plmn_id_t plmn;
+  // NR Cell ID for NR CGI (mandatory)
+  uint32_t nr_cell_id;
   // RRC Establishment Cause (mandatory)
   ngap_rrc_establishment_cause_t establishment_cause;
   // NAS-PDU (mandatory)
@@ -434,6 +436,10 @@ typedef struct ngap_uplink_nas_s {
   uint32_t gNB_ue_ngap_id;
   /* NAS pdu */
   byte_array_t nas_pdu;
+  /* UserLocationInformation (mandatory) */
+  plmn_id_t plmn; // CGI and TAI
+  uint32_t nr_cell_id; // CGI
+  uint32_t tac; // TAI
 } ngap_uplink_nas_t;
 
 typedef struct target_cell_id_s {
diff --git a/openair2/RRC/NR/nr_rrc_defs.h b/openair2/RRC/NR/nr_rrc_defs.h
index e76802338c..eaeacae5ab 100644
--- a/openair2/RRC/NR/nr_rrc_defs.h
+++ b/openair2/RRC/NR/nr_rrc_defs.h
@@ -209,6 +209,8 @@ typedef struct gNB_RRC_UE_s {
   uint64_t amf_ue_ngap_id;
   // Globally Unique AMF Identifier
   nr_guami_t ue_guami;
+  // Serving PLMN of the UE
+  plmn_id_t serving_plmn;
 
   ngap_security_capabilities_t       security_capabilities;
   //NSA block
diff --git a/openair2/RRC/NR/rrc_gNB_NGAP.c b/openair2/RRC/NR/rrc_gNB_NGAP.c
index 7d75384a9b..90b51ba118 100644
--- a/openair2/RRC/NR/rrc_gNB_NGAP.c
+++ b/openair2/RRC/NR/rrc_gNB_NGAP.c
@@ -223,17 +223,22 @@ void rrc_gNB_send_NGAP_NAS_FIRST_REQ(gNB_RRC_INST *rrc, gNB_RRC_UE_t *UE, NR_RRC
   req->nas_pdu = create_byte_array(rrcSetupComplete->dedicatedNAS_Message.size, rrcSetupComplete->dedicatedNAS_Message.buf);
 
   /* Selected PLMN Identity (Optional)
-   * selectedPLMN-Identity in RRCSetupComplete: Index of the PLMN selected by the UE from the plmn-IdentityInfoList (SIB1)
-   * Selected PLMN Identity in INITIAL UE MESSAGE: Indicates the selected PLMN id for the non-3GPP access.*/
-  if (rrcSetupComplete->selectedPLMN_Identity > rrc->configuration.num_plmn) {
+   * selectedPLMN-Identity in RRCSetupComplete: Index of the PLMN selected by the UE from the plmn-IdentityInfoList (SIB1) */
+  int idx = rrcSetupComplete->selectedPLMN_Identity - 1; // Convert 1-based PLMN Identity IE to 0-based index
+  if (idx < 0 || idx >= rrc->configuration.num_plmn) {
     LOG_E(NGAP,
-          "Failed to send Initial UE Message: selected PLMN (%ld) identity is out of bounds (%d)\n",
-          rrcSetupComplete->selectedPLMN_Identity,
+          "Failed to send Initial UE Message: selected PLMN index (%d) is out of bounds [0..%d)\n",
+          idx,
           rrc->configuration.num_plmn);
     return;
   }
-  int selected_plmn_identity = rrcSetupComplete->selectedPLMN_Identity - 1; // Convert 1-based PLMN Identity IE to 0-based index
-  req->plmn = rrc->configuration.plmn[selected_plmn_identity]; // Select from the stored list
+  req->plmn = rrc->configuration.plmn[idx]; // Select from the stored list
+  /* UE is connected to only one PLMN at a time: store this as the serving PLMN */
+  UE->serving_plmn = req->plmn;
+
+  // Cell ID (NR CGI)
+  req->nr_cell_id = UE->nr_cellid;
+  // PLMN (NR CGI and TAI)
   plmn_id_t *p = &req->plmn;
   LOG_I(NGAP, "Selected PLMN in the NG Initial UE Message: MCC=%03d MNC=%0*d\n", p->mcc, p->mnc_digit_length, p->mnc);
 
@@ -721,6 +726,10 @@ void rrc_gNB_send_NGAP_UPLINK_NAS(gNB_RRC_INST *rrc, gNB_RRC_UE_t *UE, const NR_
   NGAP_UPLINK_NAS(msg_p).gNB_ue_ngap_id = UE->rrc_ue_id;
   NGAP_UPLINK_NAS(msg_p).nas_pdu.len = nas->size;
   NGAP_UPLINK_NAS(msg_p).nas_pdu.buf = buf;
+  /* Fill PLMN and location info: use serving PLMN of the UE */
+  NGAP_UPLINK_NAS(msg_p).plmn = UE->serving_plmn;
+  NGAP_UPLINK_NAS(msg_p).nr_cell_id = rrc->nr_cellid;
+  NGAP_UPLINK_NAS(msg_p).tac = rrc->configuration.tac;
   itti_send_msg_to_task(TASK_NGAP, rrc->module_id, msg_p);
 }
 
diff --git a/openair3/NGAP/ngap_gNB_nas_procedures.c b/openair3/NGAP/ngap_gNB_nas_procedures.c
index cff9cd0b72..55cd7d61f4 100644
--- a/openair3/NGAP/ngap_gNB_nas_procedures.c
+++ b/openair3/NGAP/ngap_gNB_nas_procedures.c
@@ -181,7 +181,6 @@ int ngap_gNB_handle_nas_first_req(instance_t instance, ngap_nas_first_req_t *UEf
     .amf_ref = amf,
     .gNB_ue_ngap_id = UEfirstReq->gNB_ue_ngap_id,
     .gNB_instance = instance_p,
-    .selected_plmn_identity = UEfirstReq->plmn,
   };
 
   // RAN UE NGAP ID (M)
@@ -211,16 +210,14 @@ int ngap_gNB_handle_nas_first_req(instance_t instance, ngap_nas_first_req_t *UEf
     ie->value.choice.UserLocationInformation.present = NGAP_UserLocationInformation_PR_userLocationInformationNR;
     asn1cCalloc(ie->value.choice.UserLocationInformation.choice.userLocationInformationNR, userinfo_nr_p);
 
-    /* Set nRCellIdentity. default userLocationInformationNR */
-    MACRO_GNB_ID_TO_CELL_IDENTITY(instance_p->gNB_id,
-                                  0, // Cell ID
-                                  &userinfo_nr_p->nR_CGI.nRCellIdentity);
+    /* NR CGI: use gNB ID and Cell ID passed from RRC */
+    MACRO_GNB_ID_TO_CELL_IDENTITY(instance_p->gNB_id, UEfirstReq->nr_cell_id, &userinfo_nr_p->nR_CGI.nRCellIdentity);
 
-    plmn_id_t *plmn = &ue_desc_p.selected_plmn_identity;
+    /* Use UE's selected PLMN for nR-CGI (from Initial UE Message) */
+    plmn_id_t *plmn = &UEfirstReq->plmn;
     MCC_MNC_TO_TBCD(plmn->mcc, plmn->mnc, plmn->mnc_digit_length, &userinfo_nr_p->nR_CGI.pLMNIdentity);
 
-    /* In case of network sharing,
-       the selected PLMN is indicated by the PLMN Identity IE within the TAI IE */
+    /* Set TAI - use UE's selected PLMN */
     INT24_TO_OCTET_STRING(instance_p->tac, &userinfo_nr_p->tAI.tAC);
     MCC_MNC_TO_PLMNID(plmn->mcc, plmn->mnc, plmn->mnc_digit_length, &userinfo_nr_p->tAI.pLMNIdentity);
   }
@@ -444,17 +441,20 @@ int ngap_gNB_nas_uplink(instance_t instance, ngap_uplink_nas_t *ngap_uplink_nas_
     ie->value.choice.UserLocationInformation.present = NGAP_UserLocationInformation_PR_userLocationInformationNR;
     asn1cCalloc(ie->value.choice.UserLocationInformation.choice.userLocationInformationNR, userinfo_nr_p);
 
-    /* Set nRCellIdentity. default userLocationInformationNR */
+    /* Set nRCellIdentity: use gNB ID and Cell ID */
     MACRO_GNB_ID_TO_CELL_IDENTITY(ngap_gNB_instance_p->gNB_id,
-                                  0, // Cell ID
+                                  ngap_uplink_nas_p->nr_cell_id,
                                   &userinfo_nr_p->nR_CGI.nRCellIdentity);
-    plmn_id_t *plmn = &ue_context_p->selected_plmn_identity;
+
+    /* NR CGI */
+    plmn_id_t *plmn = &ngap_uplink_nas_p->plmn;
     MCC_MNC_TO_TBCD(plmn->mcc, plmn->mnc, plmn->mnc_digit_length, &userinfo_nr_p->nR_CGI.pLMNIdentity);
 
-    /* Set TAI */
-    INT24_TO_OCTET_STRING(ngap_gNB_instance_p->tac, &userinfo_nr_p->tAI.tAC);
+    /* TAI */
+    INT24_TO_OCTET_STRING(ngap_uplink_nas_p->tac, &userinfo_nr_p->tAI.tAC);
     MCC_MNC_TO_PLMNID(plmn->mcc, plmn->mnc, plmn->mnc_digit_length, &userinfo_nr_p->tAI.pLMNIdentity);
   }
+
   if (ngap_gNB_encode_pdu(&pdu, &buffer, &length) < 0) {
     NGAP_ERROR("Failed to encode uplink NAS transport\n");
     /* Encode procedure has failed... */
diff --git a/openair3/NGAP/ngap_gNB_ue_context.h b/openair3/NGAP/ngap_gNB_ue_context.h
index 1022f2f4c3..8053e8f8c6 100644
--- a/openair3/NGAP/ngap_gNB_ue_context.h
+++ b/openair3/NGAP/ngap_gNB_ue_context.h
@@ -69,11 +69,6 @@ typedef struct ngap_gNB_ue_context_s {
   /* Reference to AMF data this UE is attached to */
   struct ngap_gNB_amf_data_s *amf_ref;
 
-  /* Signaled by the UE in RRC Connection Setup Complete and used in NAS Uplink
-   * to route NAS messages correctly. 0-based, not 1-based as in TS 36.331
-   * 6.2.2 RRC Connection Setup Complete! */
-  plmn_id_t selected_plmn_identity;
-
   /* Reference to gNB data this UE is attached to */
   ngap_gNB_instance_t *gNB_instance;
 } ngap_gNB_ue_context_t;