diff --git a/CHANGES b/CHANGES
index 3ad9e47b38..4bd6c74b3b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+6271.	[bug]		Fix a shutdown race in dns__catz_update_cb(). [GL #4381]
+
 6267.	[func]		Adjust UDP timeouts used in zone maintenance. [GL #4260]
 
 6265.	[bug]		Don't schedule resign operations on the raw version
diff --git a/lib/dns/catz.c b/lib/dns/catz.c
index b18459eef9..a8727014ca 100644
--- a/lib/dns/catz.c
+++ b/lib/dns/catz.c
@@ -881,6 +881,13 @@ dns_catz_add_zone(dns_catz_zones_t *catzs, const dns_name_t *name,
 
 	LOCK(&catzs->lock);
 
+	/*
+	 * This function is called only during a (re)configuration, while
+	 * 'catzs->zones' can become NULL only during shutdown.
+	 */
+	INSIST(catzs->zones != NULL);
+	INSIST(!atomic_load(&catzs->shuttingdown));
+
 	result = dns_catz_new_zone(catzs, &catz, name);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
@@ -919,6 +926,10 @@ dns_catz_get_zone(dns_catz_zones_t *catzs, const dns_name_t *name) {
 	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 
 	LOCK(&catzs->lock);
+	if (catzs->zones == NULL) {
+		UNLOCK(&catzs->lock);
+		return (NULL);
+	}
 	result = isc_ht_find(catzs->zones, name->ndata, name->length,
 			     (void **)&found);
 	UNLOCK(&catzs->lock);
@@ -2299,6 +2310,11 @@ dns__catz_update_cb(void *data) {
 	 */
 	dns_name_toregion(&updb->origin, &r);
 	LOCK(&catzs->lock);
+	if (catzs->zones == NULL) {
+		UNLOCK(&catzs->lock);
+		result = ISC_R_SHUTTINGDOWN;
+		goto exit;
+	}
 	result = isc_ht_find(catzs->zones, r.base, r.length, (void **)&oldcatz);
 	is_active = (result == ISC_R_SUCCESS && oldcatz->active);
 	UNLOCK(&catzs->lock);
diff --git a/lib/dns/include/dns/catz.h b/lib/dns/include/dns/catz.h
index a2d02d6d32..ab5c614e96 100644
--- a/lib/dns/include/dns/catz.h
+++ b/lib/dns/include/dns/catz.h
@@ -311,7 +311,8 @@ isc_result_t
 dns_catz_add_zone(dns_catz_zones_t *catzs, const dns_name_t *name,
 		  dns_catz_zone_t **catzp);
 /*%<
- * Allocate a new catz named 'name' and put it in 'catzs' collection.
+ * Allocate a new catz named 'name' and put it in 'catzs' collection. This
+ * function is safe to call only during a (re)configuration.
  *
  * Requires:
  * \li	'catzs' is a valid dns_catz_zones_t.