diff --git a/bin/named/server.c b/bin/named/server.c
index 73b03d08e0..6e919d872a 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -3231,6 +3231,15 @@ configure_catz_zone(dns_view_t *view, dns_view_t *pview,
 	}
 
 	result = dns_catz_zone_add(view->catzs, &origin, &zone);
+	if (result != ISC_R_SUCCESS && result != ISC_R_EXISTS) {
+		cfg_obj_log(catz_obj, named_g_lctx, DNS_CATZ_ERROR_LEVEL,
+			    "catz: dns_catz_zone_add failed: %s",
+			    isc_result_totext(result));
+		goto cleanup;
+	}
+
+	dns_catz_zone_prereconfig(zone);
+
 	if (result == ISC_R_EXISTS) {
 		catz_reconfig_data_t data = {
 			.catz = zone,
@@ -3249,11 +3258,6 @@ configure_catz_zone(dns_view_t *view, dns_view_t *pview,
 					      &data);
 
 		result = ISC_R_SUCCESS;
-	} else if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(catz_obj, named_g_lctx, DNS_CATZ_ERROR_LEVEL,
-			    "catz: dns_catz_zone_add failed: %s",
-			    isc_result_totext(result));
-		goto cleanup;
 	}
 
 	dns_catz_zone_resetdefoptions(zone);
@@ -3291,6 +3295,8 @@ configure_catz_zone(dns_view_t *view, dns_view_t *pview,
 		opts->min_update_interval = cfg_obj_asduration(obj);
 	}
 
+	dns_catz_zone_postreconfig(zone);
+
 cleanup:
 	dns_name_free(&origin, view->mctx);
 	if (ipkl.count != 0) {
diff --git a/lib/dns/catz.c b/lib/dns/catz.c
index 0d3fe585c7..ef117c3e16 100644
--- a/lib/dns/catz.c
+++ b/lib/dns/catz.c
@@ -2598,6 +2598,16 @@ dns_catz_postreconfig(dns_catz_zones_t *catzs) {
 	isc_ht_iter_destroy(&iter);
 }
 
+void
+dns_catz_zone_prereconfig(dns_catz_zone_t *catz) {
+	LOCK(&catz->lock);
+}
+
+void
+dns_catz_zone_postreconfig(dns_catz_zone_t *catz) {
+	UNLOCK(&catz->lock);
+}
+
 void
 dns_catz_zone_for_each_entry2(dns_catz_zone_t *catz, dns_catz_entry_cb2 cb,
 			      void *arg1, void *arg2) {
diff --git a/lib/dns/include/dns/catz.h b/lib/dns/include/dns/catz.h
index 923f3b33a6..a97d885b33 100644
--- a/lib/dns/include/dns/catz.h
+++ b/lib/dns/include/dns/catz.h
@@ -409,6 +409,24 @@ dns_catz_zones_shutdown(dns_catz_zones_t *catzs);
 typedef void (*dns_catz_entry_cb2)(dns_catz_entry_t *entry, void *arg1,
 				   void *arg2);
 
+void
+dns_catz_zone_prereconfig(dns_catz_zone_t *catz);
+/*%<
+ * Must be called before reconfiguring a catalog zone. Locks the catalog zone.
+ *
+ * Requires:
+ * \li	'catz' is a valid, unlocked dns_catz_zone_t.
+ */
+
+void
+dns_catz_zone_postreconfig(dns_catz_zone_t *catz);
+/*%<
+ * Must be called after reconfiguring a catalog zone. Unlocks the catalog zone.
+ *
+ * Requires:
+ * \li	'catz' is a valid, locked dns_catz_zone_t.
+ */
+
 void
 dns_catz_zone_for_each_entry2(dns_catz_zone_t *catz, dns_catz_entry_cb2 cb,
 			      void *arg1, void *arg2);