diff --git a/daemon/dtls.c b/daemon/dtls.c
index 33d3e925c..be9aa44cf 100644
--- a/daemon/dtls.c
+++ b/daemon/dtls.c
@@ -678,13 +678,22 @@ int dtls(struct packet_stream *ps, const str *s, const endpoint_t *fsin) {
 	}
 	else if (ret == 1) {
 		/* connected! */
+		mutex_lock(&ps->out_lock); // nested lock!
 		if (dtls_setup_crypto(ps, d))
 			/* XXX ?? */ ;
+		mutex_unlock(&ps->out_lock);
+
 		if (PS_ISSET(ps, RTP) && PS_ISSET(ps, RTCP) && ps->rtcp_sibling
-				&& MEDIA_ISSET(ps->media, RTCP_MUX))
+				&& MEDIA_ISSET(ps->media, RTCP_MUX)
+				&& ps->rtcp_sibling != ps)
 		{
+			// nested locks!
+			mutex_lock(&ps->rtcp_sibling->in_lock);
+			mutex_lock(&ps->rtcp_sibling->out_lock);
 			if (dtls_setup_crypto(ps->rtcp_sibling, d))
 				/* XXX ?? */ ;
+			mutex_unlock(&ps->rtcp_sibling->out_lock);
+			mutex_unlock(&ps->rtcp_sibling->in_lock);
 		}
 	}