diff --git a/lib/dns/catz.c b/lib/dns/catz.c
index 4867a56dfc..f51c42b00e 100644
--- a/lib/dns/catz.c
+++ b/lib/dns/catz.c
@@ -890,8 +890,10 @@ dns_catz_get_zone(dns_catz_zones_t *catzs, const dns_name_t *name) {
 	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
 	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 
+	LOCK(&catzs->lock);
 	result = isc_ht_find(catzs->zones, name->ndata, name->length,
 			     (void **)&found);
+	UNLOCK(&catzs->lock);
 	if (result != ISC_R_SUCCESS) {
 		return (NULL);
 	}