diff --git a/src/core/lib/security/security_connector/ssl/ssl_security_connector.cc b/src/core/lib/security/security_connector/ssl/ssl_security_connector.cc
index 13180724cdc..552bf80138e 100644
--- a/src/core/lib/security/security_connector/ssl/ssl_security_connector.cc
+++ b/src/core/lib/security/security_connector/ssl/ssl_security_connector.cc
@@ -31,6 +31,7 @@
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gprpp/host_port.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/sync.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/ssl/ssl_credentials.h"
@@ -304,6 +305,7 @@ class grpc_ssl_server_security_connector
    * Current certificate config will continue to be used if the callback returns
    * an error. Returns true if new credentials were successfully loaded. */
   bool try_fetch_ssl_server_credentials() {
+    grpc_core::MutexLock lock(&mu_);
     grpc_ssl_server_certificate_config* certificate_config = nullptr;
     bool status;
     if (!has_cert_config_fetcher()) return false;
@@ -387,6 +389,7 @@ class grpc_ssl_server_security_connector
     server_handshaker_factory_ = new_factory;
   }
 
+  grpc_core::Mutex mu_;
   tsi_ssl_server_handshaker_factory* server_handshaker_factory_ = nullptr;
 };
 }  // namespace