diff --git a/keyserver/src/socket/tunnelbroker.js b/keyserver/src/socket/tunnelbroker.js
--- a/keyserver/src/socket/tunnelbroker.js
+++ b/keyserver/src/socket/tunnelbroker.js
@@ -2,10 +2,16 @@
 
 import WebSocket from 'ws';
 
-import { type TBKeyserverConnectionInitializationMessage } from 'lib/types/tunnelbroker-messages.js';
+import {
+  type TBKeyserverConnectionInitializationMessage,
+  type MessageFromTunnelbroker,
+  tunnelbrokerMessageTypes,
+} from 'lib/types/tunnelbroker-messages.js';
+import { ServerError } from 'lib/utils/errors.js';
 
 import { fetchOlmAccount } from '../updaters/olm-account-updater.js';
-import type { IdentityInfo } from '../user/identity.js';
+import { type IdentityInfo } from '../user/identity.js';
+import { uploadNewOneTimeKeys } from '../utils/olm-utils.js';
 
 async function createAndMaintainTunnelbrokerWebsocket(
   identityInfo: IdentityInfo,
@@ -20,6 +26,15 @@
   );
 }
 
+function handleTBMessageEvent(event: ArrayBuffer): Promise<void> {
+  const message: MessageFromTunnelbroker = JSON.parse(event.toString());
+
+  if (message.type === tunnelbrokerMessageTypes.REFRESH_KEYS_REQUEST) {
+    return uploadNewOneTimeKeys(message.numberOfKeys);
+  }
+  throw new ServerError('unsupported_tunnelbroker_message');
+}
+
 function openTunnelbrokerConnection(
   deviceID: string,
   userID: string,
@@ -48,6 +63,8 @@
     tunnelbrokerSocket.on('error', (error: Error) => {
       console.error('Tunnelbroker socket error', error.message);
     });
+
+    tunnelbrokerSocket.on('message', handleTBMessageEvent);
   } catch {
     console.log('Failed to open connection with Tunnelbroker');
   }
diff --git a/keyserver/src/utils/olm-utils.js b/keyserver/src/utils/olm-utils.js
--- a/keyserver/src/utils/olm-utils.js
+++ b/keyserver/src/utils/olm-utils.js
@@ -6,14 +6,19 @@
   Utility as OlmUtility,
   Session as OlmSession,
 } from '@commapp/olm';
+import { getRustAPI } from 'rust-node-addon';
 import uuid from 'uuid';
 
 import {
   olmEncryptedMessageTypes,
   type OLMOneTimeKeys,
 } from 'lib/types/crypto-types.js';
+import { ServerError } from 'lib/utils/errors.js';
 import { values } from 'lib/utils/objects.js';
 
+import { fetchCallUpdateOlmAccount } from '../updaters/olm-account-updater.js';
+import { fetchIdentityInfo } from '../user/identity.js';
+
 type PickledOlmAccount = {
   +picklingKey: string,
   +pickledAccount: string,
@@ -109,6 +114,45 @@
   return keys;
 }
 
+async function uploadNewOneTimeKeys(numberOfKeys: number) {
+  const [rustAPI, identityInfo] = await Promise.all([
+    getRustAPI(),
+    fetchIdentityInfo(),
+  ]);
+
+  if (!identityInfo) {
+    throw new ServerError('missing_identity_info');
+  }
+
+  await fetchCallUpdateOlmAccount('content', (contentAccount: OlmAccount) => {
+    contentAccount.generate_one_time_keys(numberOfKeys);
+    const contentOneTimeKeys = getOneTimeKeyValues(
+      contentAccount.one_time_keys(),
+    );
+    const deviceID = JSON.parse(contentAccount.identity_keys()).curve25519;
+
+    return fetchCallUpdateOlmAccount(
+      'notifications',
+      async (notifAccount: OlmAccount) => {
+        notifAccount.generate_one_time_keys(numberOfKeys);
+        const notifOneTimeKeys = getOneTimeKeyValues(
+          notifAccount.one_time_keys(),
+        );
+        await rustAPI.uploadOneTimeKeys(
+          identityInfo.userId,
+          deviceID,
+          identityInfo.accessToken,
+          contentOneTimeKeys,
+          notifOneTimeKeys,
+        );
+
+        notifAccount.mark_keys_as_published();
+        contentAccount.mark_keys_as_published();
+      },
+    );
+  });
+}
+
 export {
   createPickledOlmAccount,
   createPickledOlmSession,
@@ -117,4 +161,5 @@
   unpickleOlmSession,
   validateAccountPrekey,
   getOneTimeKeyValues,
+  uploadNewOneTimeKeys,
 };
diff --git a/lib/types/tunnelbroker-messages.js b/lib/types/tunnelbroker-messages.js
--- a/lib/types/tunnelbroker-messages.js
+++ b/lib/types/tunnelbroker-messages.js
@@ -24,7 +24,21 @@
   +notifyPlatform: 'apns' | 'fcm' | 'web' | 'wns',
 };
 
-export type TBConnectionInitializationMessage =
+export type MessageToTunnelbroker =
   | TBKeyserverConnectionInitializationMessage
   | TBClientConnectionInitializationMessage
   | TBNotifyClientConnectionInitializationMessage;
+
+export const tunnelbrokerMessageTypes = Object.freeze({
+  REFRESH_KEYS_REQUEST: 'RefreshKeyRequest',
+});
+
+export type TBRefreshKeysRequest = {
+  +type: 'RefreshKeyRequest',
+  +deviceId: string,
+  +numberOfKeys: number,
+};
+
+// Disjoint enumeration of all messages received from Tunnelbroker
+// Currently, only a single message
+export type MessageFromTunnelbroker = TBRefreshKeysRequest;