diff --git a/bazel/toolchains/BUILD b/bazel/toolchains/BUILD
index a7bc5ac73..f0cbb5c39 100644
--- a/bazel/toolchains/BUILD
+++ b/bazel/toolchains/BUILD
@@ -37,6 +37,7 @@ cc_toolchain_config(
         "-fstack-protector",
         "-Wall",
         "-Wunused-but-set-parameter",
+        "-Wthread-safety-analysis",
         "-Wno-free-nonheap-object",
         "-fno-omit-frame-pointer",
         # Needed by Envoy dependencies to build:
@@ -135,6 +136,7 @@ cc_toolchain_config(
         "-fstack-protector",
         "-Wall",
         "-Wunused-but-set-parameter",
+        "-Wthread-safety-analysis",
         "-Wno-free-nonheap-object",
         "-fno-omit-frame-pointer",
         # Needed by Envoy dependencies to build:
diff --git a/cilium/uds_client.cc b/cilium/uds_client.cc
index 485b8fd0b..9a2fce0eb 100644
--- a/cilium/uds_client.cc
+++ b/cilium/uds_client.cc
@@ -59,9 +59,11 @@ void UDSClient::Log(const std::string& msg) {
   }
 
   // rate-limit to 1/second to avoid spamming the logs
+  fd_mutex_.lock();
   if (logging_limiter_->consume(1, false)) {
     ENVOY_LOG(warn, "Logging to {} failed: {}", asStringView(), Envoy::errorDetails(errno_));
   }
+  fd_mutex_.unlock();
 }
 
 bool UDSClient::try_connect() {