diff --git a/mesh/appkey.c b/mesh/appkey.c
index 549f5a8..5088a18 100644
--- a/mesh/appkey.c
+++ b/mesh/appkey.c
@@ -50,11 +50,40 @@ static bool match_bound_key(const void *a, const void *b)
 	return key->net_idx == idx;
 }
 
+static void finalize_key(void *a, void *b)
+{
+	struct mesh_app_key *key = a;
+	uint16_t net_idx = L_PTR_TO_UINT(b);
+
+	if (key->net_idx != net_idx)
+		return;
+
+	if (key->new_key_aid == APP_AID_INVALID)
+		return;
+
+	key->key_aid = key->new_key_aid;
+
+	key->new_key_aid = APP_AID_INVALID;
+
+	memcpy(key->key, key->new_key, 16);
+}
+
+void appkey_finalize(struct mesh_net *net, uint16_t net_idx)
+{
+	struct l_queue *app_keys;
+
+	app_keys = mesh_net_get_app_keys(net);
+	if (!app_keys)
+		return;
+
+	l_queue_foreach(app_keys, finalize_key, L_UINT_TO_PTR(net_idx));
+}
+
 static struct mesh_app_key *app_key_new(void)
 {
 	struct mesh_app_key *key = l_new(struct mesh_app_key, 1);
 
-	key->new_key_aid = 0xFF;
+	key->new_key_aid = APP_AID_INVALID;
 	return key;
 }
 
@@ -146,7 +175,7 @@ const uint8_t *appkey_get_key(struct mesh_net *net, uint16_t app_idx,
 		return app_key->key;
 	}
 
-	if (app_key->new_key_aid == NET_NID_INVALID)
+	if (app_key->new_key_aid == APP_AID_INVALID)
 		return NULL;
 
 	*key_aid = app_key->new_key_aid;
diff --git a/mesh/appkey.h b/mesh/appkey.h
index 3bb7044..6688d87 100644
--- a/mesh/appkey.h
+++ b/mesh/appkey.h
@@ -16,6 +16,7 @@ struct mesh_app_key;
 bool appkey_key_init(struct mesh_net *net, uint16_t net_idx, uint16_t app_idx,
 				uint8_t *key_value, uint8_t *new_key_value);
 void appkey_key_free(void *data);
+void appkey_finalize(struct mesh_net *net, uint16_t net_idx);
 const uint8_t *appkey_get_key(struct mesh_net *net, uint16_t app_idx,
 							uint8_t *key_id);
 int appkey_get_key_idx(struct mesh_app_key *app_key,
diff --git a/mesh/mesh-defs.h b/mesh/mesh-defs.h
index 43bdf5a..25ce012 100644
--- a/mesh/mesh-defs.h
+++ b/mesh/mesh-defs.h
@@ -100,6 +100,7 @@
 
 #define NET_IDX_MAX		0x0fff
 #define APP_IDX_MAX		0x0fff
+#define APP_AID_INVALID	0xff
 
 #define APP_IDX_MASK		0x0fff
 #define APP_IDX_DEV_REMOTE	0x6fff
diff --git a/mesh/net.c b/mesh/net.c
index b24cdba..9624cd0 100644
--- a/mesh/net.c
+++ b/mesh/net.c
@@ -2600,6 +2600,8 @@ static int key_refresh_finish(struct mesh_net *net, uint16_t idx)
 
 	l_queue_foreach(net->friends, frnd_kr_phase3, net);
 
+	appkey_finalize(net, idx);
+
 	if (!mesh_config_net_key_set_phase(node_config_get(net->node), idx,
 							KEY_REFRESH_PHASE_NONE))
 		return MESH_STATUS_STORAGE_FAIL;