diff --git a/lib/kube/proxy/forwarder.go b/lib/kube/proxy/forwarder.go
index 98eb33cc016..cfb2d4b52ae 100644
--- a/lib/kube/proxy/forwarder.go
+++ b/lib/kube/proxy/forwarder.go
@@ -838,7 +838,9 @@ func (f *Forwarder) join(ctx *authContext, w http.ResponseWriter, req *http.Requ
 		return nil, trace.Wrap(err)
 	}
 
+	f.mu.Lock()
 	session := f.sessions[sessionID]
+	f.mu.Unlock()
 	if session == nil {
 		return nil, trace.NotFound("session %v not found", sessionID)
 	}
@@ -1232,7 +1234,9 @@ func (f *Forwarder) exec(ctx *authContext, w http.ResponseWriter, req *http.Requ
 	}
 
 	<-party.closeC
+	f.mu.Lock()
 	delete(f.sessions, session.id)
+	f.mu.Unlock()
 	return nil, nil
 }