diff --git a/coderd/coderd.go b/coderd/coderd.go
index e1137c6dd4..0e7d74f6f5 100644
--- a/coderd/coderd.go
+++ b/coderd/coderd.go
@@ -176,7 +176,11 @@ func New(options *Options) (http.Handler, func()) {
 		})
 	})
 	r.NotFound(site.DefaultHandler().ServeHTTP)
-	return r, api.websocketWaitGroup.Wait
+	return r, func() {
+		api.websocketWaitMutex.Lock()
+		api.websocketWaitGroup.Wait()
+		api.websocketWaitMutex.Unlock()
+	}
 }
 
 // API contains all route handlers. Only HTTP handlers should
@@ -184,5 +188,6 @@ func New(options *Options) (http.Handler, func()) {
 type api struct {
 	*Options
 
+	websocketWaitMutex sync.Mutex
 	websocketWaitGroup sync.WaitGroup
 }
diff --git a/coderd/provisionerdaemons.go b/coderd/provisionerdaemons.go
index ce203c283b..208d25f3fd 100644
--- a/coderd/provisionerdaemons.go
+++ b/coderd/provisionerdaemons.go
@@ -33,7 +33,9 @@ import (
 
 // Serves the provisioner daemon protobuf API over a WebSocket.
 func (api *api) provisionerDaemonsListen(rw http.ResponseWriter, r *http.Request) {
+	api.websocketWaitMutex.Lock()
 	api.websocketWaitGroup.Add(1)
+	api.websocketWaitMutex.Unlock()
 	defer api.websocketWaitGroup.Done()
 
 	conn, err := websocket.Accept(rw, r, &websocket.AcceptOptions{
diff --git a/coderd/workspaceresources.go b/coderd/workspaceresources.go
index 7126982169..2ecd80ea14 100644
--- a/coderd/workspaceresources.go
+++ b/coderd/workspaceresources.go
@@ -64,7 +64,9 @@ func (api *api) workspaceResource(rw http.ResponseWriter, r *http.Request) {
 }
 
 func (api *api) workspaceResourceDial(rw http.ResponseWriter, r *http.Request) {
+	api.websocketWaitMutex.Lock()
 	api.websocketWaitGroup.Add(1)
+	api.websocketWaitMutex.Unlock()
 	defer api.websocketWaitGroup.Done()
 
 	resource := httpmw.WorkspaceResourceParam(r)
@@ -112,7 +114,9 @@ func (api *api) workspaceResourceDial(rw http.ResponseWriter, r *http.Request) {
 }
 
 func (api *api) workspaceAgentListen(rw http.ResponseWriter, r *http.Request) {
+	api.websocketWaitMutex.Lock()
 	api.websocketWaitGroup.Add(1)
+	api.websocketWaitMutex.Unlock()
 	defer api.websocketWaitGroup.Done()
 
 	agent := httpmw.WorkspaceAgent(r)