diff --git a/servers/slapd/bind.c b/servers/slapd/bind.c
index e88001e4d2..4fd61bc8f9 100644
--- a/servers/slapd/bind.c
+++ b/servers/slapd/bind.c
@@ -223,7 +223,6 @@ do_bind(
 			conn->c_authmech = conn->c_sasl_bind_mech;
 			conn->c_sasl_bind_mech = NULL;
 			conn->c_sasl_bind_in_progress = 0;
-			if( ssf ) conn->c_sasl_layers++;
 			conn->c_sasl_ssf = ssf;
 			if( ssf > conn->c_ssf ) {
 				conn->c_ssf = ssf;
diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c
index 250b2ab5ac..537f1741fa 100644
--- a/servers/slapd/sasl.c
+++ b/servers/slapd/sasl.c
@@ -538,6 +538,12 @@ int slap_sasl_bind(
 			}
 
 			if( rc == LDAP_SUCCESS ) {
+				if( ssf ) {
+					ldap_pvt_thread_mutex_lock( &conn->c_mutex );
+					conn->c_sasl_layers++;
+					ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
+				}
+
 				send_ldap_sasl( conn, op, rc,
 					NULL, NULL, NULL, NULL,
 					response.bv_len ? &response : NULL );