diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 3033e8f58611d58298ab6c3c667083264bd72369..d7d65c047bb8b4d493b7511aa8f27a44e48e1e9f 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -6263,16 +6263,18 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 			INSIST(!loading);
 			INSIST(rbtversion == NULL ||
 			       rbtversion->serial >= topheader->serial);
-			if (topheader_prev != NULL)
+			if (topheader_prev != NULL) {
 				topheader_prev->next = newheader;
-			else
+			} else {
 				rbtnode->data = newheader;
+			}
 			newheader->next = topheader->next;
 			newheader->down = topheader;
 			topheader->next = newheader;
 			rbtnode->dirty = 1;
-			if (changed != NULL)
+			if (changed != NULL) {
 				changed->dirty = true;
+			}
 		} else {
 			/*
 			 * No rdatasets of the given type exist at the node.
@@ -7058,8 +7060,15 @@ loading_addrdataset(void *arg, const dns_name_t *name,
 		newheader->resign_lsb = 0;
 	}
 
+	NODE_LOCK(&rbtdb->node_locks[node->locknum].lock,
+		  isc_rwlocktype_write);
+
 	result = add32(rbtdb, node, rbtdb->current_version, newheader,
 		       DNS_DBADD_MERGE, true, NULL, 0);
+
+	NODE_UNLOCK(&rbtdb->node_locks[node->locknum].lock,
+		    isc_rwlocktype_write);
+
 	if (result == ISC_R_SUCCESS &&
 	    delegating_type(rbtdb, node, rdataset->type))
 		node->find_callback = 1;