diff --git a/pkg/runtime/depot.go b/pkg/runtime/depot.go
index 8b1dcbd168..25abe738e3 100644
--- a/pkg/runtime/depot.go
+++ b/pkg/runtime/depot.go
@@ -68,7 +68,8 @@ type depot struct {
 	config    depotConfig
 	depotPath string
 	artifacts map[strfmt.UUID]struct{}
-	fsMutex   *sync.Mutex
+	fsMutex   sync.Mutex
+	mapMutex  sync.Mutex
 	cacheSize int64
 }
 
@@ -98,7 +99,6 @@ func newDepot(runtimePath string) (*depot, error) {
 		},
 		depotPath: depotPath,
 		artifacts: map[strfmt.UUID]struct{}{},
-		fsMutex:   &sync.Mutex{},
 	}
 
 	if !fileutils.TargetExists(depotPath) {
@@ -287,6 +287,9 @@ func (d *depot) DeployViaCopy(id strfmt.UUID, relativeSrc, absoluteDest string)
 // This is automatically called by `DeployVia*()` functions.
 // This should be called for ecosystems that handle installation of artifacts.
 func (d *depot) Track(id strfmt.UUID, deploy *deployment) error {
+	d.mapMutex.Lock()
+	defer d.mapMutex.Unlock()
+
 	// Record deployment of this artifact.
 	if _, ok := d.config.Deployments[id]; !ok {
 		d.config.Deployments[id] = []deployment{}
@@ -438,6 +441,9 @@ func (d *depot) getSharedFilesToRedeploy(id strfmt.UUID, deploy deployment, path
 // Save will write config changes to disk (ie. links between depot artifacts and runtimes that use it).
 // It will also delete any stale artifacts which are not used by any runtime.
 func (d *depot) Save() error {
+	d.mapMutex.Lock()
+	defer d.mapMutex.Unlock()
+
 	// Mark artifacts that are no longer used and remove the old ones.
 	for id := range d.artifacts {
 		if deployments, ok := d.config.Deployments[id]; !ok || len(deployments) == 0 {