diff --git a/sys/dev/cxgbe/crypto/t7_kern_tls.c b/sys/dev/cxgbe/crypto/t7_kern_tls.c
--- a/sys/dev/cxgbe/crypto/t7_kern_tls.c
+++ b/sys/dev/cxgbe/crypto/t7_kern_tls.c
@@ -130,6 +130,7 @@
 	struct port_info *pi = vi->pi;
 	struct adapter *sc = pi->adapter;
 	struct tlspcb *tlsp;
+	int rxq_idx;
 
 	tlsp = malloc(sizeof(*tlsp), M_CXGBE, M_ZERO | flags);
 	if (tlsp == NULL)
@@ -141,7 +142,8 @@
 	tlsp->tx_key_addr = -1;
 	tlsp->ghash_offset = -1;
 	tlsp->rx_chid = pi->rx_chan;
-	tlsp->rx_qid = sc->sge.rxq[pi->vi->first_rxq].iq.abs_id;
+	rxq_idx = arc4random() % pi->vi->nrxq + pi->vi->first_rxq;
+	tlsp->rx_qid = sc->sge.rxq[rxq_idx].iq.abs_id;
 	mbufq_init(&tlsp->pending_mbufs, INT_MAX);
 
 	return (tlsp);
@@ -251,9 +253,12 @@
 	}
 
 	txq = &sc->sge.txq[vi->first_txq];
-	if (inp->inp_flowtype != M_HASHTYPE_NONE)
+	if (inp->inp_flowtype != M_HASHTYPE_NONE) {
 		txq += ((inp->inp_flowid % (vi->ntxq - vi->rsrv_noflowq)) +
 		    vi->rsrv_noflowq);
+		if (vi->rss_size > 1)
+			tlsp->rx_qid = vi->rss[inp->inp_flowid % vi->rss_size];
+	}
 	tlsp->txq = txq;
 	INP_RUNLOCK(inp);