--- a/opendnssec-2.1.12/signer/src/hsm.c        2022-11-08 11:46:49.000000000 +0300
+++ b/opendnssec-2.1.12/signer/src/hsm.c        2023-01-05 19:44:48.786415053 +0300
@@ -34,6 +34,10 @@
 #include "log.h"
 #include "cryptoki_compat/pkcs11.h"

+#include <pthread.h>
+
+pthread_mutex_t _hsm_get_dnskey_mutex = PTHREAD_MUTEX_INITIALIZER;
+
 static const char* hsm_str = "hsm";

 /**
@@ -109,7 +113,9 @@ llibhsm_key_start:

     /* get dnskey */
     if (!key_id->dnskey) {
+        pthread_mutex_lock(&_hsm_get_dnskey_mutex);
         key_id->dnskey = hsm_get_dnskey(ctx, keylookup(ctx, key_id->locator), key_id->params);
+        pthread_mutex_unlock(&_hsm_get_dnskey_mutex);
     }
     if (!key_id->dnskey) {
         error = hsm_get_error(ctx);