diff --git a/mod/mod.go b/mod/mod.go
index 22c841f5..79f9ac46 100644
--- a/mod/mod.go
+++ b/mod/mod.go
@@ -41,6 +41,8 @@ func Install(ctx context.Context, workspace, repoName, versionConstraint string)
 		return nil, err
 	}
 
+	defer fileLock.Unlock()
+
 	err = modfile.install(ctx, require)
 	if err != nil {
 		return nil, err
@@ -50,10 +52,6 @@ func Install(ctx context.Context, workspace, repoName, versionConstraint string)
 		return nil, err
 	}
 
-	if err := fileLock.Unlock(); err != nil {
-		return nil, err
-	}
-
 	return require, nil
 }
 
@@ -98,6 +96,8 @@ func Update(ctx context.Context, workspace, repoName, versionConstraint string)
 		return nil, err
 	}
 
+	defer fileLock.Unlock()
+
 	updatedRequire, err := modfile.updateToLatest(ctx, require)
 	if err != nil {
 		return nil, err
@@ -107,10 +107,6 @@ func Update(ctx context.Context, workspace, repoName, versionConstraint string)
 		return nil, err
 	}
 
-	if err := fileLock.Unlock(); err != nil {
-		return nil, err
-	}
-
 	return updatedRequire, nil
 }
 
diff --git a/stdlib/stdlib.go b/stdlib/stdlib.go
index f52eeb3a..b17308d7 100644
--- a/stdlib/stdlib.go
+++ b/stdlib/stdlib.go
@@ -8,6 +8,8 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+
+	"github.com/gofrs/flock"
 )
 
 var (
@@ -15,11 +17,19 @@ var (
 	//go:embed **/*.cue **/*/*.cue
 	FS embed.FS
 
-	PackageName = "alpha.dagger.io"
-	Path        = path.Join("cue.mod", "pkg", PackageName)
+	PackageName  = "alpha.dagger.io"
+	Path         = path.Join("cue.mod", "pkg", PackageName)
+	lockFilePath = path.Join("cue.mod", "dagger.lock")
 )
 
 func Vendor(ctx context.Context, mod string) error {
+	fileLock := flock.New(path.Join(mod, lockFilePath))
+	if err := fileLock.Lock(); err != nil {
+		return err
+	}
+
+	defer fileLock.Unlock()
+
 	// Remove any existing copy of the universe
 	if err := os.RemoveAll(path.Join(mod, Path)); err != nil {
 		return err