diff --git a/src/matrix/Session.js b/src/matrix/Session.js
index cd676fc5..26ab1702 100644
--- a/src/matrix/Session.js
+++ b/src/matrix/Session.js
@@ -79,18 +79,18 @@ export class Session {
         this._callHandler = new CallHandler({
             clock: this._platform.clock,
             hsApi: this._hsApi,
-            encryptDeviceMessage: async (roomId, userId, message, log) => {
+            encryptDeviceMessage: async (roomId, userId, deviceId, message, log) => {
                 if (!this._deviceTracker || !this._olmEncryption) {
                     throw new Error("encryption is not enabled");
                 }
-                // TODO: just get the devices we're sending the message to, not all the room devices
-                // although we probably already fetched all devices to send messages in the likely e2ee room
-                const devices = await log.wrap("get device keys", async log => {
-                    await this._deviceTracker.trackRoom(this.rooms.get(roomId), log);
-                    return this._deviceTracker.devicesForRoomMembers(roomId, [userId], this._hsApi, log);
+                const device = await log.wrap("get device key", async log => {
+                    return this._deviceTracker.deviceForId(userId, deviceId, this._hsApi, log);
                 });
-                const encryptedMessage = await this._olmEncryption.encrypt(message.type, message.content, devices, this._hsApi, log);
-                return encryptedMessage;
+                if (!device) {
+                    throw new Error(`Could not find device key ${deviceId} for ${userId} in ${roomId}`);
+                }
+                const encryptedMessages = await this._olmEncryption.encrypt(message.type, message.content, [device], this._hsApi, log);
+                return encryptedMessages;
             },
             storage: this._storage,
             webRTC: this._platform.webRTC,
diff --git a/src/matrix/calls/group/GroupCall.ts b/src/matrix/calls/group/GroupCall.ts
index af3966a0..b2b52e9b 100644
--- a/src/matrix/calls/group/GroupCall.ts
+++ b/src/matrix/calls/group/GroupCall.ts
@@ -55,7 +55,7 @@ function getDeviceFromMemberKey(key: string): string {
 
 export type Options = Omit<MemberOptions, "emitUpdate" | "confId" | "encryptDeviceMessage"> & {
     emitUpdate: (call: GroupCall, params?: any) => void;
-    encryptDeviceMessage: (roomId: string, userId: string, message: SignallingMessage<MGroupCallBase>, log: ILogItem) => Promise<EncryptedMessage>,
+    encryptDeviceMessage: (roomId: string, userId: string, deviceId: string, message: SignallingMessage<MGroupCallBase>, log: ILogItem) => Promise<EncryptedMessage>,
     storage: Storage,
     logger: ILogger,
 };
@@ -93,8 +93,8 @@ export class GroupCall extends EventEmitter<{change: never}> {
         this._memberOptions = Object.assign({}, options, {
             confId: this.id,
             emitUpdate: member => this._members.update(getMemberKey(member.userId, member.deviceId), member),
-            encryptDeviceMessage: (userId: string, message: SignallingMessage<MGroupCallBase>, log) => {
-                return this.options.encryptDeviceMessage(this.roomId, userId, message, log);
+            encryptDeviceMessage: (userId: string, deviceId: string, message: SignallingMessage<MGroupCallBase>, log) => {
+                return this.options.encryptDeviceMessage(this.roomId, userId, deviceId, message, log);
             }
         });
     }
diff --git a/src/matrix/calls/group/Member.ts b/src/matrix/calls/group/Member.ts
index 69e1eeea..e3abc49e 100644
--- a/src/matrix/calls/group/Member.ts
+++ b/src/matrix/calls/group/Member.ts
@@ -36,7 +36,7 @@ export type Options = Omit<PeerCallOptions, "emitUpdate" | "sendSignallingMessag
     // local session id of our client
     sessionId: string,
     hsApi: HomeServerApi,
-    encryptDeviceMessage: (userId: string, message: SignallingMessage<MGroupCallBase>, log: ILogItem) => Promise<EncryptedMessage>,
+    encryptDeviceMessage: (userId: string, deviceId: string, message: SignallingMessage<MGroupCallBase>, log: ILogItem) => Promise<EncryptedMessage>,
     emitUpdate: (participant: Member, params?: any) => void,
 }
 
@@ -217,20 +217,20 @@ export class Member {
         groupMessage.content.party_id = this.options.ownDeviceId;
         groupMessage.content.sender_session_id = this.options.sessionId;
         groupMessage.content.dest_session_id = this.sessionId;
-        // const encryptedMessages = await this.options.encryptDeviceMessage(this.member.userId, groupMessage, log);
-        // const payload = formatToDeviceMessagesPayload(encryptedMessages);
-        const payload = {
-            messages: {
-                [this.member.userId]: {
-                    [this.deviceId]: groupMessage.content
-                }
-            }
-        };
+        let payload;
+        let type: string = message.type;
+        const encryptedMessages = await this.options.encryptDeviceMessage(this.member.userId, this.deviceId, groupMessage, log);
+        if (encryptedMessages) {
+            payload = formatToDeviceMessagesPayload(encryptedMessages);
+            type = "m.room.encrypted";
+        } else {
+            // device needs deviceId and userId
+            payload = formatToDeviceMessagesPayload([{content: groupMessage.content, device: this}]);
+        }
         // TODO: remove this for release
         log.set("payload", groupMessage.content);
         const request = this.options.hsApi.sendToDevice(
-            message.type,
-            //"m.room.encrypted",
+            type,
             payload,
             makeTxnId(),
             {log}