diff --git a/lib/crypto-algorithms/megolm.js b/lib/crypto-algorithms/megolm.js
index e74e36e6e..afacb876d 100644
--- a/lib/crypto-algorithms/megolm.js
+++ b/lib/crypto-algorithms/megolm.js
@@ -87,8 +87,6 @@ MegolmEncryption.prototype._ensureOutboundSession = function(room) {
     });
 
     var self = this;
-    var txnBase = '' + (new Date().getTime()) + '.';
-    var txnCtr = 0;
 
     // TODO: we need to give the user a chance to block any devices or users
     // before we send them the keys; it's too late to download them here.
@@ -97,7 +95,12 @@ MegolmEncryption.prototype._ensureOutboundSession = function(room) {
     ).then(function(res) {
         return self._crypto.ensureOlmSessionsForUsers(roomMembers);
     }).then(function(devicemap) {
-        var promises = [];
+        // TODO: send OOB messages. for now, send an in-band message.  Each
+        // encrypted copy of the key takes up about 1K, so we'll only manage
+        // about 60 copies before we hit the event size limit; but ultimately the
+        // OOB messaging API will solve that problem for us.
+
+        var participantKeys = [];
         for (var userId in devicemap) {
             if (!devicemap.hasOwnProperty(userId)) {
                 continue;
@@ -111,38 +114,29 @@ MegolmEncryption.prototype._ensureOutboundSession = function(room) {
                 }
 
                 var deviceInfo = devices[deviceId].device;
-                var encryptedContent = olmlib.encryptMessageForDevices(
-                    self._deviceId,
-                    self._olmDevice,
-                    [deviceInfo.getIdentityKey()],
-                    payload
-                );
-
-                var txnId = txnBase + (txnCtr++);
-
-                // TODO: send an OOB message. for now, send an in-band message.
-
-                // TODO: aggregate the messages into batches. If we make a
-                // separate request for each message, we will get rate-limited.
-                // On the other hand, we can't just send them in one big batch,
-                // because we'll hit the event size limit.
-
-                var path = utils.encodeUri(
-                    "/rooms/$roomId/send/m.room.encrypted/$txnId", {
-                        $roomId: self._roomId,
-                        $txnId: txnId,
-                    }
-                );
-
-                // TODO: retries
-                var promise = self._baseApis._http.authedRequest(
-                    undefined, "PUT", path, undefined, encryptedContent
-                );
-
-                promises.push(promise);
+                participantKeys.push(deviceInfo.getIdentityKey());
             }
         }
-        return q.all(promises);
+
+        var encryptedContent = olmlib.encryptMessageForDevices(
+            self._deviceId,
+            self._olmDevice,
+            participantKeys,
+            payload
+        );
+
+        var txnId = '' + (new Date().getTime());
+        var path = utils.encodeUri(
+            "/rooms/$roomId/send/m.room.encrypted/$txnId", {
+                $roomId: self._roomId,
+                $txnId: txnId,
+            }
+        );
+
+        // TODO: retries
+        return self._baseApis._http.authedRequest(
+            undefined, "PUT", path, undefined, encryptedContent
+        );
     }).then(function() {
         // don't set this until the keys are sent successfully; if we get an
         // error, the user can restart by resending the message.