diff --git a/app/src/main/java/org/thoughtcrime/securesms/ApplicationContext.java b/app/src/main/java/org/thoughtcrime/securesms/ApplicationContext.java
index 95acc16ff6..3fa48cfa1c 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/ApplicationContext.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/ApplicationContext.java
@@ -78,6 +78,7 @@ import org.thoughtcrime.securesms.jobs.RefreshSvrCredentialsJob;
 import org.thoughtcrime.securesms.jobs.RestoreOptimizedMediaJob;
 import org.thoughtcrime.securesms.jobs.RetrieveProfileJob;
 import org.thoughtcrime.securesms.jobs.RetrieveRemoteAnnouncementsJob;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.jobs.RetryPendingSendsJob;
 import org.thoughtcrime.securesms.jobs.StoryOnboardingDownloadJob;
 import org.thoughtcrime.securesms.keyvalue.KeepMessagesDuration;
@@ -201,6 +202,7 @@ public class ApplicationContext extends Application implements AppForegroundObse
               .addNonBlocking(this::initializeCircumvention)
               .addNonBlocking(this::initializeCleanup)
               .addNonBlocking(this::initializeGlideCodecs)
+              .addNonBlocking(SealedSenderConstraint::checkAndSetValidity)
               .addNonBlocking(StorageSyncHelper::scheduleRoutineSync)
               .addNonBlocking(this::beginJobLoop)
               .addNonBlocking(EmojiSource::refresh)
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobmanager/impl/SealedSenderConstraint.kt b/app/src/main/java/org/thoughtcrime/securesms/jobmanager/impl/SealedSenderConstraint.kt
new file mode 100644
index 0000000000..67a6860bc5
--- /dev/null
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobmanager/impl/SealedSenderConstraint.kt
@@ -0,0 +1,90 @@
+package org.thoughtcrime.securesms.jobmanager.impl
+
+import android.app.job.JobInfo
+import org.signal.core.util.logging.Log
+import org.signal.libsignal.metadata.certificate.SenderCertificate
+import org.thoughtcrime.securesms.dependencies.AppDependencies
+import org.thoughtcrime.securesms.jobmanager.Constraint
+import org.thoughtcrime.securesms.jobmanager.ConstraintObserver
+import org.thoughtcrime.securesms.jobs.RotateCertificateJob
+import org.thoughtcrime.securesms.keyvalue.SignalStore
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicBoolean
+
+/**
+ * Constraint that holds jobs until the sealed sender certificate is confirmed valid.
+ * This prevents send jobs from firing with expired certificates after the device wakes
+ * from a long sleep.
+ */
+object SealedSenderConstraint : Constraint {
+
+  const val KEY = "SealedSenderConstraint"
+
+  private val TAG = Log.tag(SealedSenderConstraint::class.java)
+  private val CERTIFICATE_EXPIRATION_BUFFER = TimeUnit.DAYS.toMillis(1)
+
+  private val valid = AtomicBoolean(false)
+
+  override fun isMet(): Boolean = valid.get()
+
+  override fun getFactoryKey(): String = KEY
+
+  override fun applyToJobInfo(jobInfoBuilder: JobInfo.Builder) = Unit
+
+  @JvmStatic
+  fun markValid() {
+    valid.set(true)
+    Observer.onChange()
+  }
+
+  /**
+   * Checks all required certificate types. If all are present and not near expiry,
+   * marks the constraint as valid. Otherwise enqueues a [RotateCertificateJob] and
+   * leaves the constraint unmet until the rotation completes and calls [markValid].
+   */
+  @JvmStatic
+  fun checkAndSetValidity() {
+    try {
+      val requiredTypes = SignalStore.phoneNumberPrivacy.getRequiredCertificateTypes()
+
+      for (certificateType in requiredTypes) {
+        val certificateBytes = SignalStore.certificate.getUnidentifiedAccessCertificate(certificateType)
+
+        if (certificateBytes == null) {
+          Log.w(TAG, "Missing certificate $certificateType. Enqueuing rotation.")
+          AppDependencies.jobManager.add(RotateCertificateJob())
+          return
+        }
+
+        val certificate = SenderCertificate(certificateBytes)
+        if (System.currentTimeMillis() > certificate.expiration - CERTIFICATE_EXPIRATION_BUFFER) {
+          Log.w(TAG, "Certificate $certificateType is expired or near expiry. Enqueuing rotation.")
+          AppDependencies.jobManager.add(RotateCertificateJob())
+          return
+        }
+      }
+
+      Log.i(TAG, "All sealed sender certificates are valid.")
+      markValid()
+    } catch (e: Exception) {
+      Log.w(TAG, "Error checking certificate validity. Enqueuing rotation.", e)
+      AppDependencies.jobManager.add(RotateCertificateJob())
+    }
+  }
+
+  object Observer : ConstraintObserver {
+    private var notifier: ConstraintObserver.Notifier? = null
+
+    override fun register(notifier: ConstraintObserver.Notifier) {
+      this.notifier = notifier
+    }
+
+    fun onChange() {
+      notifier?.onConstraintMet(KEY)
+    }
+  }
+
+  class Factory : Constraint.Factory<SealedSenderConstraint> {
+    override fun create(): SealedSenderConstraint = SealedSenderConstraint
+  }
+}
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/AdminDeleteSendJob.kt b/app/src/main/java/org/thoughtcrime/securesms/jobs/AdminDeleteSendJob.kt
index df34b7a4d3..8d7e7e2510 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/AdminDeleteSendJob.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/AdminDeleteSendJob.kt
@@ -9,6 +9,7 @@ import org.thoughtcrime.securesms.database.model.MessageId
 import org.thoughtcrime.securesms.dependencies.AppDependencies
 import org.thoughtcrime.securesms.jobmanager.Job
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint
 import org.thoughtcrime.securesms.jobs.protos.AdminDeleteJobData
 import org.thoughtcrime.securesms.keyvalue.SignalStore
 import org.thoughtcrime.securesms.messages.GroupSendUtil
@@ -59,6 +60,7 @@ class AdminDeleteSendJob private constructor(
         parameters = Parameters.Builder()
           .setQueue(conversationRecipient.id.toQueueKey())
           .addConstraint(NetworkConstraint.KEY)
+          .addConstraint(SealedSenderConstraint.KEY)
           .setLifespan(1.days.inWholeMilliseconds)
           .setMaxAttempts(Parameters.UNLIMITED)
           .build()
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/AutomaticSessionResetJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/AutomaticSessionResetJob.java
index 416b6d89f1..211afb27ce 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/AutomaticSessionResetJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/AutomaticSessionResetJob.java
@@ -12,6 +12,7 @@ import org.thoughtcrime.securesms.dependencies.AppDependencies;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.DecryptionsDrainedConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.notifications.v2.ConversationId;
 import org.thoughtcrime.securesms.recipients.Recipient;
 import org.thoughtcrime.securesms.recipients.RecipientId;
@@ -52,6 +53,7 @@ public class AutomaticSessionResetJob extends BaseJob {
     this(new Parameters.Builder()
                        .setQueue(PushProcessMessageJob.getQueueName(recipientId))
                        .addConstraint(DecryptionsDrainedConstraint.KEY)
+                       .addConstraint(SealedSenderConstraint.KEY)
                        .setMaxInstancesForQueue(1)
                        .build(),
          recipientId,
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/CallLinkUpdateSendJob.kt b/app/src/main/java/org/thoughtcrime/securesms/jobs/CallLinkUpdateSendJob.kt
index b0d7707a54..840c00a4d4 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/CallLinkUpdateSendJob.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/CallLinkUpdateSendJob.kt
@@ -11,6 +11,7 @@ import org.thoughtcrime.securesms.database.SignalDatabase
 import org.thoughtcrime.securesms.dependencies.AppDependencies
 import org.thoughtcrime.securesms.jobmanager.Job
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint
 import org.thoughtcrime.securesms.jobs.protos.CallLinkUpdateSendJobData
 import org.thoughtcrime.securesms.service.webrtc.links.CallLinkRoomId
 import org.whispersystems.signalservice.api.messages.multidevice.SignalServiceSyncMessage
@@ -42,6 +43,7 @@ class CallLinkUpdateSendJob private constructor(
       .setLifespan(TimeUnit.DAYS.toMillis(1))
       .setMaxAttempts(Parameters.UNLIMITED)
       .addConstraint(NetworkConstraint.KEY)
+      .addConstraint(SealedSenderConstraint.KEY)
       .build(),
     callLinkRoomId,
     callLinkUpdateType
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/CallLogEventSendJob.kt b/app/src/main/java/org/thoughtcrime/securesms/jobs/CallLogEventSendJob.kt
index 804fd54232..b56ec589f5 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/CallLogEventSendJob.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/CallLogEventSendJob.kt
@@ -11,6 +11,7 @@ import org.thoughtcrime.securesms.database.CallTable
 import org.thoughtcrime.securesms.dependencies.AppDependencies
 import org.thoughtcrime.securesms.jobmanager.Job
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint
 import org.thoughtcrime.securesms.jobs.protos.CallLogEventSendJobData
 import org.thoughtcrime.securesms.recipients.Recipient
 import org.whispersystems.signalservice.api.messages.multidevice.SignalServiceSyncMessage
@@ -39,6 +40,7 @@ class CallLogEventSendJob private constructor(
         .setLifespan(TimeUnit.DAYS.toMillis(1))
         .setMaxAttempts(Parameters.UNLIMITED)
         .addConstraint(NetworkConstraint.KEY)
+        .addConstraint(SealedSenderConstraint.KEY)
         .build(),
       SyncMessage.CallLogEvent(
         timestamp = call.timestamp,
@@ -57,6 +59,7 @@ class CallLogEventSendJob private constructor(
         .setLifespan(TimeUnit.DAYS.toMillis(1))
         .setMaxAttempts(Parameters.UNLIMITED)
         .addConstraint(NetworkConstraint.KEY)
+        .addConstraint(SealedSenderConstraint.KEY)
         .build(),
       SyncMessage.CallLogEvent(
         timestamp = call.timestamp,
@@ -76,6 +79,7 @@ class CallLogEventSendJob private constructor(
         .setLifespan(TimeUnit.DAYS.toMillis(1))
         .setMaxAttempts(Parameters.UNLIMITED)
         .addConstraint(NetworkConstraint.KEY)
+        .addConstraint(SealedSenderConstraint.KEY)
         .build(),
       SyncMessage.CallLogEvent(
         timestamp = call.timestamp,
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/CallSyncEventJob.kt b/app/src/main/java/org/thoughtcrime/securesms/jobs/CallSyncEventJob.kt
index ca94d33af7..f1e0e8e1a4 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/CallSyncEventJob.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/CallSyncEventJob.kt
@@ -8,6 +8,7 @@ import org.thoughtcrime.securesms.dependencies.AppDependencies
 import org.thoughtcrime.securesms.jobmanager.Job
 import org.thoughtcrime.securesms.jobmanager.JsonJobData
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint
 import org.thoughtcrime.securesms.jobs.protos.CallSyncEventJobData
 import org.thoughtcrime.securesms.jobs.protos.CallSyncEventJobRecord
 import org.thoughtcrime.securesms.recipients.RecipientId
@@ -103,6 +104,7 @@ class CallSyncEventJob private constructor(
         .setLifespan(TimeUnit.DAYS.toMillis(1))
         .setMaxAttempts(Parameters.UNLIMITED)
         .addConstraint(NetworkConstraint.KEY)
+        .addConstraint(SealedSenderConstraint.KEY)
         .build()
     }
   }
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/DeviceNameChangeJob.kt b/app/src/main/java/org/thoughtcrime/securesms/jobs/DeviceNameChangeJob.kt
index 301473e815..5a3267743f 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/DeviceNameChangeJob.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/DeviceNameChangeJob.kt
@@ -4,6 +4,7 @@ import org.signal.core.util.logging.Log
 import org.thoughtcrime.securesms.dependencies.AppDependencies
 import org.thoughtcrime.securesms.jobmanager.Job
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint
 import org.thoughtcrime.securesms.jobs.protos.DeviceNameChangeJobData
 import org.thoughtcrime.securesms.recipients.Recipient
 import org.whispersystems.signalservice.api.crypto.UntrustedIdentityException
@@ -30,6 +31,7 @@ class DeviceNameChangeJob private constructor(
     DeviceNameChangeJobData(deviceId),
     Parameters.Builder()
       .addConstraint(NetworkConstraint.KEY)
+      .addConstraint(SealedSenderConstraint.KEY)
       .setQueue("DeviceNameChangeJob")
       .setLifespan(TimeUnit.DAYS.toMillis(1))
       .setMaxAttempts(Parameters.UNLIMITED)
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/GroupCallUpdateSendJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/GroupCallUpdateSendJob.java
index ea593f6ced..1faa4ed11d 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/GroupCallUpdateSendJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/GroupCallUpdateSendJob.java
@@ -10,6 +10,7 @@ import org.signal.core.util.logging.Log;
 import org.thoughtcrime.securesms.dependencies.AppDependencies;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.Job;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.messages.GroupSendUtil;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.recipients.Recipient;
@@ -71,6 +72,7 @@ public class GroupCallUpdateSendJob extends BaseJob {
                                       0L,
                                       new Parameters.Builder()
                                                     .setQueue(conversationRecipient.getId().toQueueKey())
+                                                    .addConstraint(SealedSenderConstraint.KEY)
                                                     .setLifespan(TimeUnit.MINUTES.toMillis(5))
                                                     .setMaxAttempts(3)
                                                     .build());
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/IndividualSendJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/IndividualSendJob.java
index 626001f927..e27ab85e5c 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/IndividualSendJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/IndividualSendJob.java
@@ -23,6 +23,7 @@ import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JobManager;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.mms.MmsException;
 import org.thoughtcrime.securesms.mms.OutgoingMessage;
@@ -77,6 +78,7 @@ public class IndividualSendJob extends PushSendJob {
     this(new Parameters.Builder()
              .setQueue(isScheduledSend ? recipient.getId().toScheduledSendQueueKey() : recipient.getId().toQueueKey(hasMedia))
              .addConstraint(NetworkConstraint.KEY)
+             .addConstraint(SealedSenderConstraint.KEY)
              .setLifespan(TimeUnit.DAYS.toMillis(1))
              .setMaxAttempts(Parameters.UNLIMITED)
              .build(),
@@ -259,8 +261,6 @@ public class IndividualSendJob extends PushSendJob {
     }
 
     try {
-      rotateSenderCertificateIfNecessary();
-
       Recipient messageRecipient = message.getThreadRecipient().fresh();
 
       if (messageRecipient.isUnregistered()) {
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/JobManagerFactories.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/JobManagerFactories.java
index e7fbef4c8f..120bfaf59d 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/JobManagerFactories.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/JobManagerFactories.java
@@ -16,6 +16,7 @@ import org.thoughtcrime.securesms.jobmanager.impl.BatteryNotLowConstraint;
 import org.thoughtcrime.securesms.jobmanager.impl.CellServiceConstraintObserver;
 import org.thoughtcrime.securesms.jobmanager.impl.ChangeNumberConstraint;
 import org.thoughtcrime.securesms.jobmanager.impl.ChangeNumberConstraintObserver;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.jobmanager.impl.ChargingAndBatteryIsNotLowConstraintObserver;
 import org.thoughtcrime.securesms.jobmanager.impl.ChargingConstraint;
 import org.thoughtcrime.securesms.jobmanager.impl.DataRestoreConstraint;
@@ -444,6 +445,7 @@ public final class JobManagerFactories {
       put(NotInCallConstraint.KEY,                               new NotInCallConstraint.Factory());
       put(RegisteredConstraint.KEY,                              new RegisteredConstraint.Factory());
       put(RestoreAttachmentConstraint.KEY,                       new RestoreAttachmentConstraint.Factory(application));
+      put(SealedSenderConstraint.KEY,                            new SealedSenderConstraint.Factory());
       put(SqlCipherMigrationConstraint.KEY,                      new SqlCipherMigrationConstraint.Factory(application));
       put(StickersNotDownloadingConstraint.KEY,                  new StickersNotDownloadingConstraint.Factory());
       put(WifiConstraint.KEY,                                    new WifiConstraint.Factory(application));
@@ -464,7 +466,8 @@ public final class JobManagerFactories {
                          RegisteredConstraint.Observer.INSTANCE,
                          BackupMessagesConstraintObserver.INSTANCE,
                          DeletionNotAwaitingMediaDownloadConstraint.Observer.INSTANCE,
-                         StickersNotDownloadingConstraint.Observer.INSTANCE);
+                         StickersNotDownloadingConstraint.Observer.INSTANCE,
+                         SealedSenderConstraint.Observer.INSTANCE);
   }
 
   public static List<JobMigration> getJobMigrations(@NonNull Application application) {
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceAttachmentBackfillMissingJob.kt b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceAttachmentBackfillMissingJob.kt
index b498346f14..de6ba681e7 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceAttachmentBackfillMissingJob.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceAttachmentBackfillMissingJob.kt
@@ -9,6 +9,7 @@ import org.signal.core.util.logging.Log
 import org.thoughtcrime.securesms.dependencies.AppDependencies
 import org.thoughtcrime.securesms.jobmanager.Job
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint
 import org.thoughtcrime.securesms.jobs.protos.MultiDeviceAttachmentBackfillMissingJobData
 import org.whispersystems.signalservice.api.crypto.UntrustedIdentityException
 import org.whispersystems.signalservice.api.messages.multidevice.SignalServiceSyncMessage
@@ -43,6 +44,7 @@ class MultiDeviceAttachmentBackfillMissingJob(
       .setLifespan(1.days.inWholeMilliseconds)
       .setMaxAttempts(Parameters.UNLIMITED)
       .addConstraint(NetworkConstraint.KEY)
+      .addConstraint(SealedSenderConstraint.KEY)
       .build(),
     targetMessage,
     targetConversation
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceAttachmentBackfillUpdateJob.kt b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceAttachmentBackfillUpdateJob.kt
index eb50251994..1e7b3a2b94 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceAttachmentBackfillUpdateJob.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceAttachmentBackfillUpdateJob.kt
@@ -12,6 +12,7 @@ import org.thoughtcrime.securesms.database.SignalDatabase
 import org.thoughtcrime.securesms.dependencies.AppDependencies
 import org.thoughtcrime.securesms.jobmanager.Job
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint
 import org.thoughtcrime.securesms.jobs.protos.MultiDeviceAttachmentBackfillUpdateJobData
 import org.thoughtcrime.securesms.util.MediaUtil
 import org.whispersystems.signalservice.api.crypto.UntrustedIdentityException
@@ -56,6 +57,7 @@ class MultiDeviceAttachmentBackfillUpdateJob(
       .setLifespan(JOB_LIFESPAN)
       .setMaxAttempts(Parameters.UNLIMITED)
       .addConstraint(NetworkConstraint.KEY)
+      .addConstraint(SealedSenderConstraint.KEY)
       .build(),
     targetMessage,
     targetConversation,
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceBlockedUpdateJob.kt b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceBlockedUpdateJob.kt
index 6f72cceb94..0013f96a5c 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceBlockedUpdateJob.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceBlockedUpdateJob.kt
@@ -6,6 +6,7 @@ import org.thoughtcrime.securesms.database.model.RecipientRecord
 import org.thoughtcrime.securesms.dependencies.AppDependencies
 import org.thoughtcrime.securesms.jobmanager.Job
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint
 import org.thoughtcrime.securesms.keyvalue.SignalStore
 import org.thoughtcrime.securesms.net.NotPushRegisteredException
 import org.thoughtcrime.securesms.recipients.Recipient
@@ -27,6 +28,7 @@ class MultiDeviceBlockedUpdateJob private constructor(parameters: Parameters) :
   constructor() : this(
     Parameters.Builder()
       .addConstraint(NetworkConstraint.KEY)
+      .addConstraint(SealedSenderConstraint.KEY)
       .setQueue("MultiDeviceBlockedUpdateJob")
       .setLifespan(TimeUnit.DAYS.toMillis(1))
       .setMaxAttempts(Parameters.UNLIMITED)
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceCallLinkSyncJob.kt b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceCallLinkSyncJob.kt
index f85a357ac2..61cbb911b7 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceCallLinkSyncJob.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceCallLinkSyncJob.kt
@@ -10,6 +10,7 @@ import org.signal.core.util.logging.Log
 import org.thoughtcrime.securesms.dependencies.AppDependencies
 import org.thoughtcrime.securesms.jobmanager.Job
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint
 import org.thoughtcrime.securesms.service.webrtc.links.CallLinkCredentials
 import org.whispersystems.signalservice.api.messages.multidevice.SignalServiceSyncMessage
 import org.whispersystems.signalservice.api.push.exceptions.PushNetworkException
@@ -29,6 +30,7 @@ class MultiDeviceCallLinkSyncJob private constructor(
     Parameters.Builder()
       .setQueue("__MULTI_DEVICE_CALL_LINK_UPDATE_JOB__")
       .addConstraint(NetworkConstraint.KEY)
+      .addConstraint(SealedSenderConstraint.KEY)
       .setLifespan(1.days.inWholeMilliseconds)
       .setMaxAttempts(Parameters.UNLIMITED)
       .build(),
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceConfigurationUpdateJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceConfigurationUpdateJob.java
index 8db9e7209f..704319b4b0 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceConfigurationUpdateJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceConfigurationUpdateJob.java
@@ -9,6 +9,7 @@ import org.thoughtcrime.securesms.dependencies.AppDependencies;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.recipients.Recipient;
@@ -48,6 +49,7 @@ public class MultiDeviceConfigurationUpdateJob extends BaseJob {
     this(new Job.Parameters.Builder()
                            .setQueue(QUEUE)
                            .addConstraint(NetworkConstraint.KEY)
+                           .addConstraint(SealedSenderConstraint.KEY)
                            .setMaxAttempts(10)
                            .build(),
          readReceiptsEnabled,
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceContactUpdateJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceContactUpdateJob.java
index 4ee2a03fcb..b4948f0cfd 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceContactUpdateJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceContactUpdateJob.java
@@ -23,6 +23,7 @@ import org.thoughtcrime.securesms.dependencies.AppDependencies;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.signal.core.ui.permissions.Permissions;
@@ -90,6 +91,7 @@ public class MultiDeviceContactUpdateJob extends BaseJob {
   public MultiDeviceContactUpdateJob(@Nullable RecipientId recipientId, boolean forceSync) {
     this(new Job.Parameters.Builder()
                            .addConstraint(NetworkConstraint.KEY)
+                           .addConstraint(SealedSenderConstraint.KEY)
                            .setQueue("MultiDeviceContactUpdateJob")
                            .setLifespan(TimeUnit.DAYS.toMillis(1))
                            .setMaxAttempts(Parameters.UNLIMITED)
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceDeleteSyncJob.kt b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceDeleteSyncJob.kt
index 36b44a01de..5c7019a2aa 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceDeleteSyncJob.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceDeleteSyncJob.kt
@@ -21,6 +21,7 @@ import org.thoughtcrime.securesms.database.model.MessageRecord
 import org.thoughtcrime.securesms.dependencies.AppDependencies
 import org.thoughtcrime.securesms.jobmanager.Job
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint
 import org.thoughtcrime.securesms.jobs.protos.DeleteSyncJobData
 import org.thoughtcrime.securesms.jobs.protos.DeleteSyncJobData.AttachmentDelete
 import org.thoughtcrime.securesms.jobs.protos.DeleteSyncJobData.ThreadDelete
@@ -45,6 +46,7 @@ class MultiDeviceDeleteSyncJob private constructor(
   private var data: DeleteSyncJobData,
   parameters: Parameters = Parameters.Builder()
     .addConstraint(NetworkConstraint.KEY)
+    .addConstraint(SealedSenderConstraint.KEY)
     .setMaxAttempts(Parameters.UNLIMITED)
     .setLifespan(1.days.inWholeMilliseconds)
     .build()
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceKeysUpdateJob.kt b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceKeysUpdateJob.kt
index 0443013d39..6984447715 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceKeysUpdateJob.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceKeysUpdateJob.kt
@@ -4,6 +4,7 @@ import org.signal.core.util.logging.Log
 import org.thoughtcrime.securesms.dependencies.AppDependencies
 import org.thoughtcrime.securesms.jobmanager.Job
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint
 import org.thoughtcrime.securesms.keyvalue.SignalStore
 import org.thoughtcrime.securesms.net.NotPushRegisteredException
 import org.thoughtcrime.securesms.recipients.Recipient
@@ -27,6 +28,7 @@ class MultiDeviceKeysUpdateJob private constructor(parameters: Parameters) : Bas
       .setQueue("MultiDeviceKeysUpdateJob")
       .setMaxInstancesForFactory(2)
       .addConstraint(NetworkConstraint.KEY)
+      .addConstraint(SealedSenderConstraint.KEY)
       .setMaxAttempts(10)
       .build()
   )
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceMessageRequestResponseJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceMessageRequestResponseJob.java
index 73efc7ff0e..36086d860c 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceMessageRequestResponseJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceMessageRequestResponseJob.java
@@ -9,6 +9,7 @@ import org.thoughtcrime.securesms.dependencies.AppDependencies;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.recipients.Recipient;
@@ -64,6 +65,7 @@ public class MultiDeviceMessageRequestResponseJob extends BaseJob {
   private MultiDeviceMessageRequestResponseJob(@NonNull RecipientId threadRecipient, @NonNull Type type) {
     this(new Parameters.Builder().setQueue("MultiDeviceMessageRequestResponseJob")
                                  .addConstraint(NetworkConstraint.KEY)
+                                 .addConstraint(SealedSenderConstraint.KEY)
                                  .setMaxAttempts(Parameters.UNLIMITED)
                                  .setLifespan(TimeUnit.DAYS.toMillis(1))
                                  .build(),
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceOutgoingPaymentSyncJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceOutgoingPaymentSyncJob.java
index 15ad62969b..e2c2bfeb11 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceOutgoingPaymentSyncJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceOutgoingPaymentSyncJob.java
@@ -10,6 +10,7 @@ import org.thoughtcrime.securesms.dependencies.AppDependencies;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.payments.proto.PaymentMetaData;
@@ -44,6 +45,7 @@ public final class MultiDeviceOutgoingPaymentSyncJob extends BaseJob {
     this(new Parameters.Builder()
                        .setQueue("MultiDeviceOutgoingPaymentSyncJob")
                        .addConstraint(NetworkConstraint.KEY)
+                       .addConstraint(SealedSenderConstraint.KEY)
                        .setLifespan(TimeUnit.DAYS.toMillis(1))
                        .build(),
          sentPaymentId);
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceProfileContentUpdateJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceProfileContentUpdateJob.java
index 4199423594..4f0a7106b1 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceProfileContentUpdateJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceProfileContentUpdateJob.java
@@ -7,6 +7,7 @@ import org.signal.core.util.logging.Log;
 import org.thoughtcrime.securesms.dependencies.AppDependencies;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.recipients.Recipient;
@@ -27,6 +28,7 @@ public class MultiDeviceProfileContentUpdateJob extends BaseJob {
                        .setQueue("MultiDeviceProfileUpdateJob")
                        .setMaxInstancesForFactory(2)
                        .addConstraint(NetworkConstraint.KEY)
+                       .addConstraint(SealedSenderConstraint.KEY)
                        .setMaxAttempts(10)
                        .build());
   }
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceProfileKeyUpdateJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceProfileKeyUpdateJob.java
index 4775d5d12a..8b85eeadd4 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceProfileKeyUpdateJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceProfileKeyUpdateJob.java
@@ -11,6 +11,7 @@ import org.thoughtcrime.securesms.crypto.ProfileKeyUtil;
 import org.thoughtcrime.securesms.dependencies.AppDependencies;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.recipients.Recipient;
@@ -41,6 +42,7 @@ public class MultiDeviceProfileKeyUpdateJob extends BaseJob {
   public MultiDeviceProfileKeyUpdateJob() {
     this(new Job.Parameters.Builder()
                            .addConstraint(NetworkConstraint.KEY)
+                           .addConstraint(SealedSenderConstraint.KEY)
                            .setQueue("MultiDeviceProfileKeyUpdateJob")
                            .setLifespan(TimeUnit.DAYS.toMillis(1))
                            .setMaxAttempts(Parameters.UNLIMITED)
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceReadUpdateJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceReadUpdateJob.java
index 683a2296fc..e47f81d464 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceReadUpdateJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceReadUpdateJob.java
@@ -14,6 +14,7 @@ import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JobManager;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.recipients.Recipient;
@@ -47,6 +48,7 @@ public class MultiDeviceReadUpdateJob extends BaseJob {
   private MultiDeviceReadUpdateJob(List<SyncMessageId> messageIds) {
     this(new Job.Parameters.Builder()
                            .addConstraint(NetworkConstraint.KEY)
+                           .addConstraint(SealedSenderConstraint.KEY)
                            .setLifespan(TimeUnit.DAYS.toMillis(1))
                            .setMaxAttempts(Parameters.UNLIMITED)
                            .build(),
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceStickerPackOperationJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceStickerPackOperationJob.java
index f2dff4b308..434e293be5 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceStickerPackOperationJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceStickerPackOperationJob.java
@@ -9,6 +9,7 @@ import org.thoughtcrime.securesms.dependencies.AppDependencies;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.util.TextSecurePreferences;
 import org.whispersystems.signalservice.api.SignalServiceMessageSender;
@@ -41,6 +42,7 @@ public class MultiDeviceStickerPackOperationJob extends BaseJob {
     this(new Job.Parameters.Builder()
                            .setQueue("MultiDeviceStickerPackOperationJob")
                            .addConstraint(NetworkConstraint.KEY)
+                           .addConstraint(SealedSenderConstraint.KEY)
                            .setLifespan(TimeUnit.DAYS.toMillis(1))
                            .build(),
         packId,
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceStickerPackSyncJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceStickerPackSyncJob.java
index 10e5e50154..04f1db9826 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceStickerPackSyncJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceStickerPackSyncJob.java
@@ -11,6 +11,7 @@ import org.thoughtcrime.securesms.database.model.StickerPackRecord;
 import org.thoughtcrime.securesms.dependencies.AppDependencies;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.recipients.Recipient;
@@ -38,6 +39,7 @@ public class MultiDeviceStickerPackSyncJob extends BaseJob {
     this(new Parameters.Builder()
                            .setQueue("MultiDeviceStickerPackSyncJob")
                            .addConstraint(NetworkConstraint.KEY)
+                           .addConstraint(SealedSenderConstraint.KEY)
                            .setLifespan(TimeUnit.DAYS.toMillis(1))
                            .build());
   }
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceStorageSyncRequestJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceStorageSyncRequestJob.java
index e4fe439cfa..265f5b7e43 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceStorageSyncRequestJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceStorageSyncRequestJob.java
@@ -7,6 +7,7 @@ import org.signal.core.util.logging.Log;
 import org.thoughtcrime.securesms.dependencies.AppDependencies;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.recipients.Recipient;
@@ -27,6 +28,7 @@ public class MultiDeviceStorageSyncRequestJob extends BaseJob {
                        .setQueue("MultiDeviceStorageSyncRequestJob")
                        .setMaxInstancesForFactory(2)
                        .addConstraint(NetworkConstraint.KEY)
+                       .addConstraint(SealedSenderConstraint.KEY)
                        .setMaxAttempts(10)
                        .build());
   }
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceStorySendSyncJob.kt b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceStorySendSyncJob.kt
index 0764592c7d..d95d38eda4 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceStorySendSyncJob.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceStorySendSyncJob.kt
@@ -6,6 +6,7 @@ import org.thoughtcrime.securesms.dependencies.AppDependencies
 import org.thoughtcrime.securesms.jobmanager.Job
 import org.thoughtcrime.securesms.jobmanager.JsonJobData
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint
 import org.thoughtcrime.securesms.recipients.Recipient
 import org.whispersystems.signalservice.api.messages.SignalServiceStoryMessageRecipient
 import org.whispersystems.signalservice.api.messages.multidevice.SentTranscriptMessage
@@ -33,6 +34,7 @@ class MultiDeviceStorySendSyncJob private constructor(parameters: Parameters, pr
       return MultiDeviceStorySendSyncJob(
         parameters = Parameters.Builder()
           .addConstraint(NetworkConstraint.KEY)
+          .addConstraint(SealedSenderConstraint.KEY)
           .setMaxAttempts(Parameters.UNLIMITED)
           .setLifespan(TimeUnit.DAYS.toMillis(1))
           .setQueue(KEY)
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceSubscriptionSyncRequestJob.kt b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceSubscriptionSyncRequestJob.kt
index 04a6fce316..319bb12e8a 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceSubscriptionSyncRequestJob.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceSubscriptionSyncRequestJob.kt
@@ -4,6 +4,7 @@ import org.signal.core.util.logging.Log
 import org.thoughtcrime.securesms.dependencies.AppDependencies
 import org.thoughtcrime.securesms.jobmanager.Job
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint
 import org.thoughtcrime.securesms.keyvalue.SignalStore
 import org.thoughtcrime.securesms.net.NotPushRegisteredException
 import org.thoughtcrime.securesms.recipients.Recipient
@@ -28,6 +29,7 @@ class MultiDeviceSubscriptionSyncRequestJob private constructor(parameters: Para
           .setQueue("MultiDeviceSubscriptionSyncRequestJob")
           .setMaxInstancesForFactory(2)
           .addConstraint(NetworkConstraint.KEY)
+          .addConstraint(SealedSenderConstraint.KEY)
           .setMaxAttempts(10)
           .build()
       )
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceVerifiedUpdateJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceVerifiedUpdateJob.java
index db9f0e5662..cbcc0eab2e 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceVerifiedUpdateJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceVerifiedUpdateJob.java
@@ -13,6 +13,7 @@ import org.thoughtcrime.securesms.dependencies.AppDependencies;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.recipients.Recipient;
@@ -49,6 +50,7 @@ public class MultiDeviceVerifiedUpdateJob extends BaseJob {
   public MultiDeviceVerifiedUpdateJob(@NonNull RecipientId destination, IdentityKey identityKey, VerifiedStatus verifiedStatus) {
     this(new Job.Parameters.Builder()
                            .addConstraint(NetworkConstraint.KEY)
+                           .addConstraint(SealedSenderConstraint.KEY)
                            .setQueue("__MULTI_DEVICE_VERIFIED_UPDATE__")
                            .setLifespan(TimeUnit.DAYS.toMillis(1))
                            .setMaxAttempts(Parameters.UNLIMITED)
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceViewOnceOpenJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceViewOnceOpenJob.java
index 9519c44ae2..08f15181ae 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceViewOnceOpenJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceViewOnceOpenJob.java
@@ -11,6 +11,7 @@ import org.thoughtcrime.securesms.dependencies.AppDependencies;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.recipients.Recipient;
@@ -42,6 +43,7 @@ public class MultiDeviceViewOnceOpenJob extends BaseJob {
   public MultiDeviceViewOnceOpenJob(SyncMessageId messageId) {
     this(new Parameters.Builder()
                        .addConstraint(NetworkConstraint.KEY)
+                       .addConstraint(SealedSenderConstraint.KEY)
                        .setLifespan(TimeUnit.DAYS.toMillis(1))
                        .setMaxAttempts(Parameters.UNLIMITED)
                        .build(),
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceViewedUpdateJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceViewedUpdateJob.java
index e7090684c5..d48d14aef7 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceViewedUpdateJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/MultiDeviceViewedUpdateJob.java
@@ -14,6 +14,7 @@ import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JobManager;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.recipients.Recipient;
@@ -47,6 +48,7 @@ public class MultiDeviceViewedUpdateJob extends BaseJob {
   private MultiDeviceViewedUpdateJob(List<SyncMessageId> messageIds) {
     this(new Parameters.Builder()
                        .addConstraint(NetworkConstraint.KEY)
+                       .addConstraint(SealedSenderConstraint.KEY)
                        .setLifespan(TimeUnit.DAYS.toMillis(1))
                        .setMaxAttempts(Parameters.UNLIMITED)
                        .build(),
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/NullMessageSendJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/NullMessageSendJob.java
index 9e710ad6ce..ed5d732932 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/NullMessageSendJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/NullMessageSendJob.java
@@ -9,6 +9,7 @@ import org.thoughtcrime.securesms.dependencies.AppDependencies;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.recipients.Recipient;
 import org.thoughtcrime.securesms.recipients.RecipientId;
 import org.thoughtcrime.securesms.recipients.RecipientUtil;
@@ -37,6 +38,7 @@ public class NullMessageSendJob extends BaseJob {
          new Parameters.Builder()
                        .setQueue(recipientId.toQueueKey())
                        .addConstraint(NetworkConstraint.KEY)
+                       .addConstraint(SealedSenderConstraint.KEY)
                        .setLifespan(TimeUnit.DAYS.toMillis(1))
                        .setMaxAttempts(Parameters.UNLIMITED)
                        .build());
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/PollVoteJob.kt b/app/src/main/java/org/thoughtcrime/securesms/jobs/PollVoteJob.kt
index d926d1735b..507c7dc6fa 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/PollVoteJob.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/PollVoteJob.kt
@@ -7,6 +7,7 @@ import org.thoughtcrime.securesms.dependencies.AppDependencies
 import org.thoughtcrime.securesms.groups.GroupId
 import org.thoughtcrime.securesms.jobmanager.Job
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint
 import org.thoughtcrime.securesms.jobs.protos.PollVoteJobData
 import org.thoughtcrime.securesms.keyvalue.SignalStore
 import org.thoughtcrime.securesms.messages.GroupSendUtil
@@ -66,6 +67,7 @@ class PollVoteJob(
         parameters = Parameters.Builder()
           .setQueue(conversationRecipient.id.toQueueKey())
           .addConstraint(NetworkConstraint.KEY)
+          .addConstraint(SealedSenderConstraint.KEY)
           .setMaxAttempts(Parameters.UNLIMITED)
           .setLifespan(1.days.inWholeMilliseconds)
           .build()
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/ProfileKeySendJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/ProfileKeySendJob.java
index f5777226be..fa2d399ce5 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/ProfileKeySendJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/ProfileKeySendJob.java
@@ -12,6 +12,7 @@ import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.DecryptionsDrainedConstraint;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.messages.GroupSendUtil;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.ratelimit.ProofRequiredExceptionHandler;
@@ -48,6 +49,7 @@ public class ProfileKeySendJob extends BaseJob {
             .setMaxInstancesForQueue(Parameters.UNLIMITED)
             .addConstraint(NetworkConstraint.KEY)
             .addConstraint(DecryptionsDrainedConstraint.KEY)
+            .addConstraint(SealedSenderConstraint.KEY)
             .setLifespan(TimeUnit.DAYS.toMillis(1))
             .setMaxAttempts(Parameters.UNLIMITED)
             .build(),
@@ -104,6 +106,7 @@ public class ProfileKeySendJob extends BaseJob {
                                                  .setMaxInstancesForQueue(1)
                                                  .addConstraint(NetworkConstraint.KEY)
                                                  .addConstraint(DecryptionsDrainedConstraint.KEY)
+                                                 .addConstraint(SealedSenderConstraint.KEY)
                                                  .setLifespan(TimeUnit.DAYS.toMillis(1))
                                                  .setMaxAttempts(Parameters.UNLIMITED)
                                                  .build(), threadId, recipients);
@@ -111,6 +114,7 @@ public class ProfileKeySendJob extends BaseJob {
       return new ProfileKeySendJob(new Parameters.Builder()
                                                  .setQueue(conversationRecipient.getId().toQueueKey())
                                                  .addConstraint(NetworkConstraint.KEY)
+                                                 .addConstraint(SealedSenderConstraint.KEY)
                                                  .setLifespan(TimeUnit.DAYS.toMillis(1))
                                                  .setMaxAttempts(Parameters.UNLIMITED)
                                                  .build(), threadId, recipients);
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/PushDistributionListSendJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/PushDistributionListSendJob.java
index 77d85c6d8e..25be498e86 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/PushDistributionListSendJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/PushDistributionListSendJob.java
@@ -24,6 +24,7 @@ import org.thoughtcrime.securesms.jobmanager.JobLogger;
 import org.thoughtcrime.securesms.jobmanager.JobManager;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.messages.GroupSendUtil;
 import org.thoughtcrime.securesms.messages.StorySendUtil;
 import org.thoughtcrime.securesms.mms.MmsException;
@@ -70,6 +71,7 @@ public final class PushDistributionListSendJob extends PushSendJob {
     this(new Parameters.Builder()
              .setQueue(destination.toQueueKey(hasMedia))
              .addConstraint(NetworkConstraint.KEY)
+             .addConstraint(SealedSenderConstraint.KEY)
              .setLifespan(TimeUnit.DAYS.toMillis(1))
              .setMaxAttempts(Parameters.UNLIMITED)
              .build(),
@@ -204,8 +206,6 @@ public final class PushDistributionListSendJob extends PushSendJob {
       throws IOException, UntrustedIdentityException, UndeliverableMessageException
   {
     try {
-      rotateSenderCertificateIfNecessary();
-
       List<Attachment>                    attachments        = Stream.of(message.getAttachments()).filterNot(Attachment::isSticker).toList();
       List<SignalServiceAttachment> attachmentPointers = getAttachmentPointersFor(attachments);
       List<BodyRange>               bodyRanges         = getBodyRanges(message);
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/PushGroupSendJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/PushGroupSendJob.java
index 95aace05ba..265b107a24 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/PushGroupSendJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/PushGroupSendJob.java
@@ -32,6 +32,7 @@ import org.thoughtcrime.securesms.jobmanager.JobLogger;
 import org.thoughtcrime.securesms.jobmanager.JobManager;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.messages.GroupSendUtil;
 import org.thoughtcrime.securesms.messages.StorySendUtil;
 import org.thoughtcrime.securesms.mms.MessageGroupContext;
@@ -95,6 +96,7 @@ public final class PushGroupSendJob extends PushSendJob {
     this(new Job.Parameters.Builder()
              .setQueue(isScheduledSend ? destination.toScheduledSendQueueKey() : destination.toQueueKey(hasMedia))
              .addConstraint(NetworkConstraint.KEY)
+             .addConstraint(SealedSenderConstraint.KEY)
              .setLifespan(TimeUnit.DAYS.toMillis(1))
              .setMaxAttempts(Parameters.UNLIMITED)
              .build(),
@@ -276,8 +278,6 @@ public final class PushGroupSendJob extends PushSendJob {
     }
 
     try {
-      rotateSenderCertificateIfNecessary();
-
       GroupId.Push                                     groupId            = groupRecipient.requireGroupId().requirePush();
       Optional<byte[]>                                 profileKey         = getProfileKey(groupRecipient);
       Optional<SignalServiceDataMessage.Sticker>       sticker            = getStickerFor(message);
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/PushGroupSilentUpdateSendJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/PushGroupSilentUpdateSendJob.java
index 068ce86160..72e63e2cd7 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/PushGroupSilentUpdateSendJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/PushGroupSilentUpdateSendJob.java
@@ -15,6 +15,7 @@ import org.thoughtcrime.securesms.database.RecipientTable;
 import org.thoughtcrime.securesms.database.SignalDatabase;
 import org.thoughtcrime.securesms.groups.GroupId;
 import org.thoughtcrime.securesms.jobmanager.Job;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.messages.GroupSendUtil;
@@ -96,6 +97,7 @@ public final class PushGroupSilentUpdateSendJob extends BaseJob {
                                             groupContext,
                                             new Parameters.Builder()
                                                           .setQueue(queue)
+                                                          .addConstraint(SealedSenderConstraint.KEY)
                                                           .setLifespan(TimeUnit.DAYS.toMillis(1))
                                                           .setMaxAttempts(Parameters.UNLIMITED)
                                                           .setGlobalPriority(Parameters.PRIORITY_LOW)
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/PushSendJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/PushSendJob.java
index f58fd8c6b8..801f97bf60 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/PushSendJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/PushSendJob.java
@@ -17,8 +17,6 @@ import com.annimon.stream.Stream;
 import org.greenrobot.eventbus.EventBus;
 import org.signal.core.util.Hex;
 import org.signal.core.util.logging.Log;
-import org.signal.libsignal.metadata.certificate.InvalidCertificateException;
-import org.signal.libsignal.metadata.certificate.SenderCertificate;
 import org.signal.libsignal.zkgroup.InvalidInputException;
 import org.signal.libsignal.zkgroup.receipts.ReceiptCredentialPresentation;
 import org.signal.blurhash.BlurHash;
@@ -46,7 +44,6 @@ import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JobManager;
 import org.thoughtcrime.securesms.jobmanager.JobTracker;
 import org.thoughtcrime.securesms.jobmanager.impl.BackoffUtil;
-import org.thoughtcrime.securesms.keyvalue.CertificateType;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.linkpreview.LinkPreview;
 import org.thoughtcrime.securesms.mms.OutgoingMessage;
@@ -84,7 +81,6 @@ import java.util.Collection;
 import java.util.HashSet;
 import java.util.LinkedList;
 import java.util.List;
-import java.util.Locale;
 import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.TimeUnit;
@@ -93,7 +89,6 @@ import java.util.stream.Collectors;
 public abstract class PushSendJob extends SendJob {
 
   private static final String TAG                           = Log.tag(PushSendJob.class);
-  private static final long   CERTIFICATE_EXPIRATION_BUFFER = TimeUnit.DAYS.toMillis(1);
   private static final long   PUSH_CHALLENGE_TIMEOUT        = TimeUnit.SECONDS.toMillis(10);
 
   protected PushSendJob(Job.Parameters parameters) {
@@ -556,39 +551,6 @@ public abstract class PushSendJob extends SendJob {
     }
   }
 
-  protected void rotateSenderCertificateIfNecessary() throws IOException {
-    try {
-      Collection<CertificateType> requiredCertificateTypes = SignalStore.phoneNumberPrivacy()
-                                                                        .getRequiredCertificateTypes();
-
-      Log.i(TAG, "Ensuring we have these certificates " + requiredCertificateTypes);
-
-      for (CertificateType certificateType : requiredCertificateTypes) {
-
-        byte[] certificateBytes = SignalStore.certificate()
-                                             .getUnidentifiedAccessCertificate(certificateType);
-
-        if (certificateBytes == null) {
-          throw new InvalidCertificateException(String.format("No certificate %s was present.", certificateType));
-        }
-
-        SenderCertificate certificate = new SenderCertificate(certificateBytes);
-
-        if (System.currentTimeMillis() > (certificate.getExpiration() - CERTIFICATE_EXPIRATION_BUFFER)) {
-          throw new InvalidCertificateException(String.format(Locale.US, "Certificate %s is expired, or close to it. Expires on: %d, currently: %d", certificateType, certificate.getExpiration(), System.currentTimeMillis()));
-        }
-        Log.d(TAG, String.format("Certificate %s is valid", certificateType));
-      }
-
-      Log.d(TAG, "All certificates are valid.");
-    } catch (InvalidCertificateException e) {
-      Log.w(TAG, "A certificate was invalid at send time. Fetching new ones.", e);
-      if (!AppDependencies.getJobManager().runSynchronously(new RotateCertificateJob(), 5000).isPresent()) {
-        throw new IOException("Timeout rotating certificate");
-      }
-    }
-  }
-
   protected abstract void onPushSend() throws Exception;
 
 }
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/ReactionSendJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/ReactionSendJob.java
index 3195b103b8..32ba62cdcc 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/ReactionSendJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/ReactionSendJob.java
@@ -18,6 +18,7 @@ import org.thoughtcrime.securesms.groups.GroupId;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.messages.GroupSendUtil;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
@@ -91,6 +92,7 @@ public class ReactionSendJob extends BaseJob {
                                new Parameters.Builder()
                                              .setQueue(conversationRecipient.getId().toQueueKey())
                                              .addConstraint(NetworkConstraint.KEY)
+                                             .addConstraint(SealedSenderConstraint.KEY)
                                              .setLifespan(TimeUnit.DAYS.toMillis(1))
                                              .setMaxAttempts(Parameters.UNLIMITED)
                                              .build());
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/RemoteDeleteSendJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/RemoteDeleteSendJob.java
index f2ea5cc596..3dc2ca0a8a 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/RemoteDeleteSendJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/RemoteDeleteSendJob.java
@@ -20,6 +20,7 @@ import org.thoughtcrime.securesms.groups.GroupId;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JobManager;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.messages.GroupSendUtil;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.recipients.Recipient;
@@ -83,6 +84,7 @@ public class RemoteDeleteSendJob extends BaseJob {
                                                           recipients.size(),
                                                           new Parameters.Builder()
                                                                         .setQueue(conversationRecipient.getId().toQueueKey())
+                                                                        .addConstraint(SealedSenderConstraint.KEY)
                                                                         .setLifespan(TimeUnit.DAYS.toMillis(1))
                                                                         .setMaxAttempts(Parameters.UNLIMITED)
                                                                         .build());
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/ResendMessageJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/ResendMessageJob.java
index 4ef54ac931..4f8143a5b1 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/ResendMessageJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/ResendMessageJob.java
@@ -16,6 +16,7 @@ import org.thoughtcrime.securesms.groups.GroupId;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.recipients.Recipient;
 import org.thoughtcrime.securesms.recipients.RecipientId;
@@ -83,6 +84,7 @@ public class ResendMessageJob extends BaseJob {
                                  .setLifespan(TimeUnit.DAYS.toMillis(1))
                                  .setMaxAttempts(Parameters.UNLIMITED)
                                  .addConstraint(NetworkConstraint.KEY)
+                                 .addConstraint(SealedSenderConstraint.KEY)
                                  .build());
   }
 
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/RotateCertificateJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/RotateCertificateJob.java
index bea4b6590e..ed3a5eb377 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/RotateCertificateJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/RotateCertificateJob.java
@@ -6,6 +6,7 @@ import androidx.annotation.Nullable;
 import org.signal.core.util.logging.Log;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.CertificateType;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.net.SignalNetwork;
@@ -75,6 +76,8 @@ public final class RotateCertificateJob extends BaseJob {
                    .setUnidentifiedAccessCertificate(certificateType, certificate);
       }
     }
+
+    SealedSenderConstraint.markValid();
   }
 
   @Override
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/SendDeliveryReceiptJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/SendDeliveryReceiptJob.java
index a435164545..48b7dd1cc1 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/SendDeliveryReceiptJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/SendDeliveryReceiptJob.java
@@ -13,6 +13,7 @@ import org.thoughtcrime.securesms.dependencies.AppDependencies;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.recipients.Recipient;
 import org.thoughtcrime.securesms.recipients.RecipientId;
@@ -52,6 +53,7 @@ public class SendDeliveryReceiptJob extends BaseJob {
   public SendDeliveryReceiptJob(@NonNull RecipientId recipientId, long messageSentTimestamp, @NonNull MessageId messageId) {
     this(new Job.Parameters.Builder()
                            .addConstraint(NetworkConstraint.KEY)
+                           .addConstraint(SealedSenderConstraint.KEY)
                            .setLifespan(TimeUnit.DAYS.toMillis(1))
                            .setMaxAttempts(Parameters.UNLIMITED)
                            .setQueue(recipientId.toQueueKey())
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/SendReadReceiptJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/SendReadReceiptJob.java
index b8e2834ad0..dd6b1a90ec 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/SendReadReceiptJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/SendReadReceiptJob.java
@@ -16,6 +16,7 @@ import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JobManager;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.recipients.Recipient;
 import org.thoughtcrime.securesms.recipients.RecipientId;
@@ -64,6 +65,7 @@ public class SendReadReceiptJob extends BaseJob {
   public SendReadReceiptJob(long threadId, @NonNull RecipientId recipientId, List<Long> messageSentTimestamps, List<MessageId> messageIds) {
     this(new Job.Parameters.Builder()
                            .addConstraint(NetworkConstraint.KEY)
+                           .addConstraint(SealedSenderConstraint.KEY)
                            .setLifespan(TimeUnit.DAYS.toMillis(1))
                            .setMaxAttempts(Parameters.UNLIMITED)
                            .setQueue(recipientId.toQueueKey())
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/SendRetryReceiptJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/SendRetryReceiptJob.java
index 37cec0fa99..3dfb6c2d2f 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/SendRetryReceiptJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/SendRetryReceiptJob.java
@@ -13,6 +13,7 @@ import org.thoughtcrime.securesms.groups.GroupId;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.recipients.Recipient;
 import org.thoughtcrime.securesms.recipients.RecipientId;
 import org.thoughtcrime.securesms.recipients.RecipientUtil;
@@ -42,6 +43,7 @@ public final class SendRetryReceiptJob extends BaseJob {
          errorMessage,
          new Parameters.Builder()
                        .addConstraint(NetworkConstraint.KEY)
+                       .addConstraint(SealedSenderConstraint.KEY)
                        .setQueue(recipientId.toQueueKey())
                        .setMaxAttempts(Parameters.UNLIMITED)
                        .setLifespan(TimeUnit.DAYS.toMillis(1))
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/SendViewedReceiptJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/SendViewedReceiptJob.java
index d8e6a58c69..ffab5ef933 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/SendViewedReceiptJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/SendViewedReceiptJob.java
@@ -18,6 +18,7 @@ import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JobManager;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.keyvalue.SignalStore;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.recipients.Recipient;
@@ -69,6 +70,7 @@ public class SendViewedReceiptJob extends BaseJob {
   private SendViewedReceiptJob(long threadId, @NonNull RecipientId recipientId, @NonNull List<Long> messageSentTimestamps, @NonNull List<MessageId> messageIds) {
     this(new Parameters.Builder()
              .addConstraint(NetworkConstraint.KEY)
+             .addConstraint(SealedSenderConstraint.KEY)
              .setLifespan(TimeUnit.DAYS.toMillis(1))
              .setMaxAttempts(Parameters.UNLIMITED)
              .build(),
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/SenderKeyDistributionSendJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/SenderKeyDistributionSendJob.java
index 1bd0f8db24..03ce36a3ae 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/SenderKeyDistributionSendJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/SenderKeyDistributionSendJob.java
@@ -14,6 +14,7 @@ import org.thoughtcrime.securesms.groups.GroupId;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.recipients.Recipient;
 import org.thoughtcrime.securesms.recipients.RecipientId;
 import org.thoughtcrime.securesms.recipients.RecipientUtil;
@@ -50,6 +51,7 @@ public final class SenderKeyDistributionSendJob extends BaseJob {
     this(targetRecipientId, threadRecipientId, new Parameters.Builder()
                                                              .setQueue(targetRecipientId.toQueueKey())
                                                              .addConstraint(NetworkConstraint.KEY)
+                                                             .addConstraint(SealedSenderConstraint.KEY)
                                                              .setLifespan(TimeUnit.DAYS.toMillis(1))
                                                              .setMaxAttempts(Parameters.UNLIMITED)
                                                              .setMaxInstancesForQueue(1)
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/TypingSendJob.java b/app/src/main/java/org/thoughtcrime/securesms/jobs/TypingSendJob.java
index dea91b82b6..8951e62fcc 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/TypingSendJob.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/TypingSendJob.java
@@ -12,6 +12,7 @@ import org.thoughtcrime.securesms.groups.GroupId;
 import org.thoughtcrime.securesms.jobmanager.JsonJobData;
 import org.thoughtcrime.securesms.jobmanager.Job;
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint;
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint;
 import org.thoughtcrime.securesms.messages.GroupSendUtil;
 import org.thoughtcrime.securesms.net.NotPushRegisteredException;
 import org.thoughtcrime.securesms.recipients.Recipient;
@@ -43,6 +44,7 @@ public class TypingSendJob extends BaseJob {
                            .setMaxAttempts(1)
                            .setLifespan(TimeUnit.SECONDS.toMillis(5))
                            .addConstraint(NetworkConstraint.KEY)
+                           .addConstraint(SealedSenderConstraint.KEY)
                            .setMemoryOnly(true)
                            .build(),
          threadId,
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/UnpinMessageJob.kt b/app/src/main/java/org/thoughtcrime/securesms/jobs/UnpinMessageJob.kt
index 14b3c15a25..e0d40aa14f 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/UnpinMessageJob.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/UnpinMessageJob.kt
@@ -8,6 +8,7 @@ import org.thoughtcrime.securesms.groups.GroupAccessControl
 import org.thoughtcrime.securesms.groups.GroupId
 import org.thoughtcrime.securesms.jobmanager.Job
 import org.thoughtcrime.securesms.jobmanager.impl.NetworkConstraint
+import org.thoughtcrime.securesms.jobmanager.impl.SealedSenderConstraint
 import org.thoughtcrime.securesms.jobs.protos.UnpinJobData
 import org.thoughtcrime.securesms.keyvalue.SignalStore
 import org.thoughtcrime.securesms.messages.GroupSendUtil
@@ -66,6 +67,7 @@ class UnpinMessageJob(
         parameters = Parameters.Builder()
           .setQueue(conversationRecipient.id.toQueueKey())
           .addConstraint(NetworkConstraint.KEY)
+          .addConstraint(SealedSenderConstraint.KEY)
           .setMaxAttempts(Parameters.UNLIMITED)
           .setLifespan(1.days.inWholeMilliseconds)
           .build()