diff --git a/ci-scripts/conf_files/gnb.sa.band78.51prb.aw2s.ddsuu.conf b/ci-scripts/conf_files/gnb.sa.band78.51prb.aw2s.ddsuu.conf
index 5c37a2a413..3cbdc151d2 100644
--- a/ci-scripts/conf_files/gnb.sa.band78.51prb.aw2s.ddsuu.conf
+++ b/ci-scripts/conf_files/gnb.sa.band78.51prb.aw2s.ddsuu.conf
@@ -257,6 +257,23 @@ THREAD_STRUCT = (
   }
 );
 
+security = {
+  # preferred ciphering algorithms
+  # the first one of the list that an UE supports in chosen
+  # valid values: nea0, nea1, nea2, nea3
+  ciphering_algorithms = ( "nea2", "nea0" );
+
+  # preferred integrity algorithms
+  # the first one of the list that an UE supports in chosen
+  # valid values: nia0, nia1, nia2, nia3
+  integrity_algorithms = ( "nia2", "nia0" );
+
+  # setting 'drb_ciphering' to "no" disables ciphering for DRBs, no matter
+  # what 'ciphering_algorithms' configures; same thing for 'drb_integrity'
+  drb_ciphering = "yes";
+  drb_integrity = "yes";
+};
+
      log_config :
      {
        global_log_level                      ="info";
diff --git a/openair2/LAYER2/nr_pdcp/nr_pdcp_security_nea2.c b/openair2/LAYER2/nr_pdcp/nr_pdcp_security_nea2.c
index c46a9d59fe..e54b854125 100644
--- a/openair2/LAYER2/nr_pdcp/nr_pdcp_security_nea2.c
+++ b/openair2/LAYER2/nr_pdcp/nr_pdcp_security_nea2.c
@@ -50,7 +50,7 @@ void nr_pdcp_security_nea2_cipher(void *security_context, unsigned char *buffer,
   memcpy(p.key, ciphering_key, 16);
   p.type = AES_INITIALIZATION_VECTOR_16;
   p.iv16.d.count = ntohl(count);
-  p.iv16.d.bearer = bearer;
+  p.iv16.d.bearer = bearer - 1;
   p.iv16.d.direction = direction;
 
   uint8_t out[length];