diff --git a/go/kbfs/libkbfs/keybase_service_base.go b/go/kbfs/libkbfs/keybase_service_base.go
index 970d43330c33..ec5efd09af89 100644
--- a/go/kbfs/libkbfs/keybase_service_base.go
+++ b/go/kbfs/libkbfs/keybase_service_base.go
@@ -300,8 +300,10 @@ func (k *KeybaseServiceBase) setCachedTeamInfo(
 
 func (k *KeybaseServiceBase) getCachedNotWriter(
 	tid keybase1.TeamID, uid keybase1.UID) (notWriter bool) {
-	k.teamCacheLock.RLock()
-	defer k.teamCacheLock.RUnlock()
+	// Full write lock because of the delete-after-expiration code
+	// below.
+	k.teamCacheLock.Lock()
+	defer k.teamCacheLock.Unlock()
 	cachedTime, notWriter := k.notWriterCache[tid][uid]
 	if !notWriter {
 		return false