diff --git a/keyserver/src/socket/tunnelbroker-socket.js b/keyserver/src/socket/tunnelbroker-socket.js
--- a/keyserver/src/socket/tunnelbroker-socket.js
+++ b/keyserver/src/socket/tunnelbroker-socket.js
@@ -1,5 +1,6 @@
 // @flow
 
+import _debounce from 'lodash/debounce.js';
 import uuid from 'uuid';
 import WebSocket from 'ws';
 
@@ -109,7 +110,7 @@
         const messageToKeyserver = JSON.parse(payload);
         if (refreshKeysRequestValidator.is(messageToKeyserver)) {
           const request: RefreshKeyRequest = messageToKeyserver;
-          this.refreshOneTimeKeys(request.numberOfKeys);
+          this.debouncedRefreshOneTimeKeys(request.numberOfKeys);
         }
       } catch (e) {
         console.error(
@@ -159,6 +160,12 @@
     })();
   };
 
+  debouncedRefreshOneTimeKeys: (numberOfKeys: number) => void = _debounce(
+    this.refreshOneTimeKeys,
+    100,
+    { leading: true, trailing: true },
+  );
+
   sendMessage: (message: ClientMessageToDevice) => Promise<void> = (
     message: ClientMessageToDevice,
   ) => {