diff --git a/internal/oci/runtime_oci.go b/internal/oci/runtime_oci.go
index 8e94f5f498d..9d0b44c3784 100644
--- a/internal/oci/runtime_oci.go
+++ b/internal/oci/runtime_oci.go
@@ -699,6 +699,9 @@ func TruncateAndReadFile(ctx context.Context, path string, size int64) ([]byte,
 
 // UpdateContainer updates container resources
 func (r *runtimeOCI) UpdateContainer(ctx context.Context, c *Container, res *rspec.LinuxResources) error {
+	c.opLock.Lock()
+	defer c.opLock.Unlock()
+
 	if c.Spoofed() {
 		return nil
 	}