diff --git a/rpmio/rpmkeyring.cc b/rpmio/rpmkeyring.cc
index 58f5bc90ee..0d8f922593 100644
--- a/rpmio/rpmkeyring.cc
+++ b/rpmio/rpmkeyring.cc
@@ -179,15 +179,21 @@ rpmPubkey *rpmGetSubkeys(rpmPubkey primarykey, int *count)
     int pgpsubkeysCount = 0;
     int i;
 
-    if (primarykey && !pgpPrtParamsSubkeys(primarykey->pkt.data(), primarykey->pkt.size(),
-	    primarykey->pgpkey, &pgpsubkeys, &pgpsubkeysCount)) {
-	/* Returned to C, can't use new */
-	subkeys = (rpmPubkey *)xmalloc(pgpsubkeysCount * sizeof(*subkeys));
-	for (i = 0; i < pgpsubkeysCount; i++) {
-	    subkeys[i] = rpmPubkeyNewSubkey(primarykey, pgpsubkeys[i]);
-	    primarykey = pubkeyLink(primarykey);
+    if (primarykey) {
+
+	rdlock lock(primarykey->mutex);
+
+	if (!pgpPrtParamsSubkeys(
+		primarykey->pkt.data(), primarykey->pkt.size(),
+		primarykey->pgpkey, &pgpsubkeys, &pgpsubkeysCount)) {
+	    /* Returned to C, can't use new */
+	    subkeys = (rpmPubkey *)xmalloc(pgpsubkeysCount * sizeof(*subkeys));
+	    for (i = 0; i < pgpsubkeysCount; i++) {
+		subkeys[i] = rpmPubkeyNewSubkey(primarykey, pgpsubkeys[i]);
+		primarykey = pubkeyLink(primarykey);
+	    }
+	    free(pgpsubkeys);
 	}
-	free(pgpsubkeys);
     }
     *count = pgpsubkeysCount;