diff --git a/include/libcamera/internal/pipeline_handler.h b/include/libcamera/internal/pipeline_handler.h
index a7331cedf..e5b8ffb4d 100644
--- a/include/libcamera/internal/pipeline_handler.h
+++ b/include/libcamera/internal/pipeline_handler.h
@@ -14,6 +14,7 @@
 #include <sys/types.h>
 #include <vector>
 
+#include <libcamera/base/mutex.h>
 #include <libcamera/base/object.h>
 
 #include <libcamera/controls.h>
@@ -88,7 +89,8 @@ private:
 
 	const char *name_;
 
-	bool lockOwner_;
+	Mutex lock_;
+	bool lockOwner_ LIBCAMERA_TSA_GUARDED_BY(lock_); /* *Not* ownership of lock_ */
 
 	friend class PipelineHandlerFactory;
 };
diff --git a/src/libcamera/pipeline_handler.cpp b/src/libcamera/pipeline_handler.cpp
index a9241ac62..03e4b9e66 100644
--- a/src/libcamera/pipeline_handler.cpp
+++ b/src/libcamera/pipeline_handler.cpp
@@ -11,6 +11,7 @@
 #include <sys/sysmacros.h>
 
 #include <libcamera/base/log.h>
+#include <libcamera/base/mutex.h>
 #include <libcamera/base/utils.h>
 
 #include <libcamera/camera.h>
@@ -155,6 +156,8 @@ MediaDevice *PipelineHandler::acquireMediaDevice(DeviceEnumerator *enumerator,
  */
 bool PipelineHandler::lock()
 {
+	MutexLocker locker(lock_);
+
 	/* Do not allow nested locking in the same libcamera instance. */
 	if (lockOwner_)
 		return false;
@@ -183,6 +186,8 @@ bool PipelineHandler::lock()
  */
 void PipelineHandler::unlock()
 {
+	MutexLocker locker(lock_);
+
 	if (!lockOwner_)
 		return;