diff --git a/tests-integration/v3_test.go b/tests-integration/v3_test.go
index 38b3a60..ad3c0c6 100644
--- a/tests-integration/v3_test.go
+++ b/tests-integration/v3_test.go
@@ -99,8 +99,10 @@ func (s *testV2Server) addAccountWithDeviceID(userID, deviceID, token string) {
 
 // like invalidateToken, but doesn't do any waiting.
 func (s *testV2Server) invalidateTokenImmediately(token string) {
+	s.mu.Lock()
 	delete(s.tokenToUser, token)
 	delete(s.tokenToDevice, token)
+	s.mu.Unlock()
 }
 
 // remove the token and wait until the proxy sends a request with this token, then 401 it and return.