diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index fa6ed8ab5b61dc843af8ef6accbe208507d6a173..a742bcb9cf23cb1a8e23a96c33b5b9a02b28dd32 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -10760,6 +10760,7 @@ zone_refreshkeys(dns_zone_t *zone) {
 #ifdef ENABLE_AFL
 		if (!dns_fuzzing_resolver) {
 #endif /* ifdef ENABLE_AFL */
+			UNLOCK_ZONE(zone);
 			result = dns_resolver_createfetch(
 				zone->view->resolver, kname,
 				dns_rdatatype_dnskey, NULL, NULL, NULL, NULL, 0,
@@ -10769,6 +10770,7 @@ zone_refreshkeys(dns_zone_t *zone) {
 				0, NULL, zone->task, keyfetch_done, kfetch,
 				&kfetch->dnskeyset, &kfetch->dnskeysigset,
 				&kfetch->fetch);
+			LOCK_ZONE(zone);
 #ifdef ENABLE_AFL
 		} else {
 			result = ISC_R_FAILURE;