diff --git a/CHANGES b/CHANGES
index 0c749d1511..c84d7aca99 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+6386.	[bug]		When shutting down catzs->view could point to freed
+			memory. Obtain a reference to the view to prevent this.
+			[GL #4502]
+
 6385.	[func]		Relax SVCB alias mode checks to allow parameters.
 			[GL #4704]
 
diff --git a/bin/named/server.c b/bin/named/server.c
index aed1058364..f6549ab436 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -2704,7 +2704,7 @@ catz_addmodzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 		goto cleanup;
 	}
 
-	result = dns_zt_find(ev->view->zonetable, name, 0, NULL, &zone);
+	result = dns_view_findzone(ev->view, name, &zone);
 
 	if (ev->mod) {
 		dns_catz_zone_t *parentcatz;
@@ -2881,7 +2881,7 @@ cleanup:
 	}
 	dns_catz_entry_detach(ev->origin, &ev->entry);
 	dns_catz_detach_catz(&ev->origin);
-	dns_view_detach(&ev->view);
+	dns_view_weakdetach(&ev->view);
 	isc_event_free(ISC_EVENT_PTR(&ev));
 }
 
@@ -2899,8 +2899,8 @@ catz_delzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 
 	dns_name_format(dns_catz_entry_getname(ev->entry), cname,
 			DNS_NAME_FORMATSIZE);
-	result = dns_zt_find(ev->view->zonetable,
-			     dns_catz_entry_getname(ev->entry), 0, NULL, &zone);
+	result = dns_view_findzone(ev->view, dns_catz_entry_getname(ev->entry),
+				   &zone);
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
@@ -2956,7 +2956,7 @@ cleanup:
 	}
 	dns_catz_entry_detach(ev->origin, &ev->entry);
 	dns_catz_detach_catz(&ev->origin);
-	dns_view_detach(&ev->view);
+	dns_view_weakdetach(&ev->view);
 	isc_event_free(ISC_EVENT_PTR(&ev));
 }
 
@@ -2998,7 +2998,7 @@ catz_create_chg_task(dns_catz_entry_t *entry, dns_catz_zone_t *origin,
 
 	dns_catz_entry_attach(entry, &event->entry);
 	dns_catz_attach_catz(origin, &event->origin);
-	dns_view_attach(view, &event->view);
+	dns_view_weakattach(view, &event->view);
 
 	isc_task_send(task, ISC_EVENT_PTR(&event));
 	isc_task_detach(&task);
diff --git a/lib/dns/catz.c b/lib/dns/catz.c
index a8727014ca..613805221f 100644
--- a/lib/dns/catz.c
+++ b/lib/dns/catz.c
@@ -525,7 +525,7 @@ dns__catz_zones_merge(dns_catz_zone_t *catz, dns_catz_zone_t *newcatz) {
 	     result = delcur ? isc_ht_iter_delcurrent_next(iter1)
 			     : isc_ht_iter_next(iter1))
 	{
-		isc_result_t zt_find_result;
+		isc_result_t find_result;
 		dns_catz_zone_t *parentcatz = NULL;
 		dns_catz_entry_t *nentry = NULL;
 		dns_catz_entry_t *oentry = NULL;
@@ -558,10 +558,10 @@ dns__catz_zones_merge(dns_catz_zone_t *catz, dns_catz_zone_t *newcatz) {
 					    &catz->zoneoptions, &nentry->opts);
 
 		/* Try to find the zone in the view */
-		zt_find_result = dns_zt_find(catz->catzs->view->zonetable,
-					     dns_catz_entry_getname(nentry), 0,
-					     NULL, &zone);
-		if (zt_find_result == ISC_R_SUCCESS) {
+		find_result = dns_view_findzone(catz->catzs->view,
+						dns_catz_entry_getname(nentry),
+						&zone);
+		if (find_result == ISC_R_SUCCESS) {
 			dns_catz_coo_t *coo = NULL;
 			char pczname[DNS_NAME_FORMATSIZE];
 			bool parentcatz_locked = false;
@@ -606,10 +606,6 @@ dns__catz_zones_merge(dns_catz_zone_t *catz, dns_catz_zone_t *newcatz) {
 				UNLOCK(&parentcatz->lock);
 				LOCK(&catz->lock);
 			}
-		}
-		if (zt_find_result == ISC_R_SUCCESS ||
-		    zt_find_result == DNS_R_PARTIALMATCH)
-		{
 			dns_zone_detach(&zone);
 		}
 
@@ -617,8 +613,7 @@ dns__catz_zones_merge(dns_catz_zone_t *catz, dns_catz_zone_t *newcatz) {
 		result = isc_ht_find(catz->entries, key, (uint32_t)keysize,
 				     (void **)&oentry);
 		if (result != ISC_R_SUCCESS) {
-			if (zt_find_result == ISC_R_SUCCESS &&
-			    parentcatz == catz)
+			if (find_result == ISC_R_SUCCESS && parentcatz == catz)
 			{
 				/*
 				 * This means that the zone's unique label
@@ -645,7 +640,7 @@ dns__catz_zones_merge(dns_catz_zone_t *catz, dns_catz_zone_t *newcatz) {
 			continue;
 		}
 
-		if (zt_find_result != ISC_R_SUCCESS) {
+		if (find_result != ISC_R_SUCCESS) {
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 				      DNS_LOGMODULE_MASTER, ISC_LOG_DEBUG(3),
 				      "catz: zone '%s' was expected to exist "
@@ -818,7 +813,12 @@ dns_catz_catzs_set_view(dns_catz_zones_t *catzs, dns_view_t *view) {
 	/* Either it's a new one or it's being reconfigured. */
 	REQUIRE(catzs->view == NULL || !strcmp(catzs->view->name, view->name));
 
-	catzs->view = view;
+	if (catzs->view == NULL) {
+		dns_view_weakattach(view, &catzs->view);
+	} else if (catzs->view != view) {
+		dns_view_weakdetach(&catzs->view);
+		dns_view_weakattach(view, &catzs->view);
+	}
 }
 
 isc_result_t
@@ -1034,6 +1034,9 @@ dns__catz_zones_destroy(dns_catz_zones_t *catzs) {
 	isc_task_detach(&catzs->updater);
 	isc_mutex_destroy(&catzs->lock);
 	isc_refcount_destroy(&catzs->references);
+	if (catzs->view != NULL) {
+		dns_view_weakdetach(&catzs->view);
+	}
 
 	isc_mem_putanddetach(&catzs->mctx, catzs, sizeof(*catzs));
 }