diff --git a/Podfile.lock b/Podfile.lock
index 1b830b351..32da18b1b 100644
--- a/Podfile.lock
+++ b/Podfile.lock
@@ -263,7 +263,7 @@ CHECKOUT OPTIONS:
     :commit: ff0b95770520133b83a4bd7b26bc2c90b51abc4d
     :git: https://github.com/signalapp/SignalCoreKit.git
   SignalMetadataKit:
-    :commit: beb10a358db0202228b8d67bcb466d877fefb405
+    :commit: 90f3dee7122ff13061770c496001135ba90b71e3
     :git: https://github.com/signalapp/SignalMetadataKit
   SocketRocket:
     :commit: 9f9563a83cd8960503074aa8de72206f83fb7a69
diff --git a/SignalServiceKit/src/Messages/OWSMessageSender.m b/SignalServiceKit/src/Messages/OWSMessageSender.m
index 943348052..d4da8ac7d 100644
--- a/SignalServiceKit/src/Messages/OWSMessageSender.m
+++ b/SignalServiceKit/src/Messages/OWSMessageSender.m
@@ -996,12 +996,13 @@ NSString *const OWSMessageSenderRateLimitedException = @"RateLimitedException";
         OWSLogWarn(@"Sending a message with no device messages.");
     }
 
+    const BOOL isUDSend = messageSend.isUDSend;
     TSRequest *request = [OWSRequestFactory submitMessageRequestWithRecipient:recipient.uniqueId
                                                                      messages:deviceMessages
                                                                     timeStamp:message.timestamp
                                                            unidentifiedAccess:messageSend.unidentifiedAccess];
 
-    OWSWebSocketType webSocketType = (messageSend.isUDSend ? OWSWebSocketTypeUD : OWSWebSocketTypeDefault);
+    OWSWebSocketType webSocketType = (isUDSend ? OWSWebSocketTypeUD : OWSWebSocketTypeDefault);
     BOOL canMakeWebsocketRequests = ([TSSocketManager.shared canMakeRequestsOfType:webSocketType] &&
                                      !messageSend.hasWebsocketSendFailed);
     if (canMakeWebsocketRequests) {
@@ -1014,6 +1015,19 @@ NSString *const OWSMessageSenderRateLimitedException = @"RateLimitedException";
                 dispatch_async([OWSDispatch sendingQueue], ^{
                     OWSLogDebug(@"Web socket send failed; failing over to REST.");
 
+                    if (isUDSend && (statusCode == 401 || statusCode == 403)) {
+                        // If a UD send fails due to service response (as opposed to network
+                        // failure), mark recipient as _not_ in UD mode, then retry.
+                        OWSLogDebug(@"UD send failed; failing over to non-UD send.");
+                        [self.udManager setUnidentifiedAccessMode:UnidentifiedAccessModeDisabled
+                                                      recipientId:recipient.uniqueId];
+                        messageSend.hasUDAuthFailed = YES;
+                        dispatch_async([OWSDispatch sendingQueue], ^{
+                            [self sendMessageToRecipient:messageSend];
+                        });
+                        return;
+                    }
+
                     // Websockets can fail in different ways, so we don't decrement remainingAttempts for websocket
                     // failure. Instead we fall back to REST, which will decrement retries. e.g. after linking a new
                     // device, sync messages will fail until the websocket re-opens.
@@ -1031,11 +1045,9 @@ NSString *const OWSMessageSenderRateLimitedException = @"RateLimitedException";
                 NSInteger statusCode = response.statusCode;
                 NSData *_Nullable responseData = error.userInfo[AFNetworkingOperationFailingURLResponseDataErrorKey];
 
-                if (messageSend.isUDSend && (statusCode == 401 || statusCode == 403)) {
+                if (isUDSend && (statusCode == 401 || statusCode == 403)) {
                     // If a UD send fails due to service response (as opposed to network
                     // failure), mark recipient as _not_ in UD mode, then retry.
-                    //
-                    // TODO: Do we want to discriminate based on exact error?
                     OWSLogDebug(@"UD send failed; failing over to non-UD send.");
                     [self.udManager setUnidentifiedAccessMode:UnidentifiedAccessModeDisabled
                                                   recipientId:recipient.uniqueId];