diff --git a/lib/call-session.js b/lib/call-session.js
index 6eb7df1..e0d8bb0 100644
--- a/lib/call-session.js
+++ b/lib/call-session.js
@@ -188,6 +188,7 @@ class CallSession extends Emitter {
     this.rtpEngineResource = {destroy: this.del.bind(null, this.rtpEngineOpts.common)};
     let proxy, uris = [];
     const mapGateways = new Map();
+    let encryptedMedia = false;
 
     try {
       // determine where to send the call
@@ -325,6 +326,7 @@ class CallSession extends Emitter {
                  */
                 this.logger.info({u}, `using SRTP for outbound call, pad crypto: ${o.pad_crypto ? 'yes' : 'no'}`);
                 this.rtpEngineOpts = makeRtpEngineOpts(this.req, false, true, o.pad_crypto, true);
+                encryptedMedia = true;
               }
             });
             // Check private network for each gw
@@ -530,6 +532,7 @@ class CallSession extends Emitter {
           // these are all final failure scenarios
           if (uris.length === 0 ||          // exhausted all targets
             earlyMedia ||                   // failure after early media
+            encryptedMedia ||               // cant crank back when using encrypted media as keys have been exchanged
             !(err instanceof SipError) ||   // unexpected error
             err.status === 487) {           // caller hung up