diff --git a/src/libfetchers/filtering-source-accessor.cc b/src/libfetchers/filtering-source-accessor.cc
index 72a3fb4eb..c9dd4f136 100644
--- a/src/libfetchers/filtering-source-accessor.cc
+++ b/src/libfetchers/filtering-source-accessor.cc
@@ -1,4 +1,5 @@
 #include "nix/fetchers/filtering-source-accessor.hh"
+#include "nix/util/sync.hh"
 
 namespace nix {
 
@@ -57,8 +58,8 @@ void FilteringSourceAccessor::checkAccess(const CanonPath & path)
 
 struct AllowListSourceAccessorImpl : AllowListSourceAccessor
 {
-    std::set<CanonPath> allowedPrefixes;
-    std::unordered_set<CanonPath> allowedPaths;
+    SharedSync<std::set<CanonPath>> allowedPrefixes;
+    SharedSync<std::unordered_set<CanonPath>> allowedPaths;
 
     AllowListSourceAccessorImpl(
         ref<SourceAccessor> next,
@@ -73,13 +74,13 @@ struct AllowListSourceAccessorImpl : AllowListSourceAccessor
     bool isAllowed(const CanonPath & path) override
     {
         return
-            allowedPaths.contains(path)
-            || path.isAllowed(allowedPrefixes);
+            allowedPaths.readLock()->contains(path)
+            || path.isAllowed(*allowedPrefixes.readLock());
     }
 
     void allowPrefix(CanonPath prefix) override
     {
-        allowedPrefixes.insert(std::move(prefix));
+        allowedPrefixes.lock()->insert(std::move(prefix));
     }
 };