diff --git a/coderd/cryptokeys/cache.go b/coderd/cryptokeys/cache.go
index 43d673548ce06..0b2af2fa73ca4 100644
--- a/coderd/cryptokeys/cache.go
+++ b/coderd/cryptokeys/cache.go
@@ -251,14 +251,14 @@ func (c *cache) cryptoKey(ctx context.Context, sequence int32) (string, []byte,
 	}
 
 	c.fetching = true
-	c.mu.Unlock()
 
+	c.mu.Unlock()
 	keys, err := c.cryptoKeys(ctx)
+	c.mu.Lock()
 	if err != nil {
 		return "", nil, xerrors.Errorf("get keys: %w", err)
 	}
 
-	c.mu.Lock()
 	c.lastFetch = c.clock.Now()
 	c.refresher.Reset(refreshInterval)
 	c.keys = keys