diff --git a/module/zfs/dsl_crypt.c b/module/zfs/dsl_crypt.c
index 8e1055d9bc..6aa4eb0b6e 100644
--- a/module/zfs/dsl_crypt.c
+++ b/module/zfs/dsl_crypt.c
@@ -1134,6 +1134,7 @@ spa_keystore_lookup_key(spa_t *spa, uint64_t dsobj, const void *tag,
 	/* init the search key mapping */
 	search_km.km_dsobj = dsobj;
 
+	rw_enter(&spa->spa_keystore.sk_dk_lock, RW_READER);
 	rw_enter(&spa->spa_keystore.sk_km_lock, RW_READER);
 
 	/* remove the mapping from the tree */
@@ -1148,6 +1149,7 @@ spa_keystore_lookup_key(spa_t *spa, uint64_t dsobj, const void *tag,
 		zfs_refcount_add(&found_km->km_key->dck_holds, tag);
 
 	rw_exit(&spa->spa_keystore.sk_km_lock);
+	rw_exit(&spa->spa_keystore.sk_dk_lock);
 
 	if (dck_out != NULL)
 		*dck_out = found_km->km_key;
@@ -1155,6 +1157,7 @@ spa_keystore_lookup_key(spa_t *spa, uint64_t dsobj, const void *tag,
 
 error_unlock:
 	rw_exit(&spa->spa_keystore.sk_km_lock);
+	rw_exit(&spa->spa_keystore.sk_dk_lock);
 
 	if (dck_out != NULL)
 		*dck_out = NULL;