diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 2886c64c33..68e6a89c0a 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -7158,9 +7158,10 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	 * this is deferred until closeversion() is called.
 	 */
 	if (result == ISC_R_SUCCESS && version == NULL && !IS_CACHE(rbtdb)) {
-		RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
-		iszonesecure(db, rbtdb->current_version, rbtdb->origin_node);
-		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
+		RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
+		version = rbtdb->current_version;
+		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
+		iszonesecure(db, version, rbtdb->origin_node);
 	}
 
 	return (result);
@@ -7218,9 +7219,10 @@ deleterdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	 * this is deferred until closeversion() is called.
 	 */
 	if (result == ISC_R_SUCCESS && version == NULL && !IS_CACHE(rbtdb)) {
-		RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
-		iszonesecure(db, rbtdb->current_version, rbtdb->origin_node);
-		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
+		RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
+		version = rbtdb->current_version;
+		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
+		iszonesecure(db, version, rbtdb->origin_node);
 	}
 
 	return (result);
@@ -7708,9 +7710,12 @@ endload(dns_db_t *db, dns_rdatacallbacks_t *callbacks) {
 	 * zone key, we consider the zone secure.
 	 */
 	if (! IS_CACHE(rbtdb) && rbtdb->origin_node != NULL) {
-		iszonesecure(db, rbtdb->current_version, rbtdb->origin_node);
+		dns_dbversion_t *version = rbtdb->current_version;
+		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
+		iszonesecure(db, version, rbtdb->origin_node);
+	} else {
+		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
 	}
-	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
 
 	callbacks->add = NULL;
 	callbacks->add_private = NULL;