diff --git a/libwvdrmengine/cdm/core/test/test_base.cpp b/libwvdrmengine/cdm/core/test/test_base.cpp
index 9ee7352d..a6894d38 100644
--- a/libwvdrmengine/cdm/core/test/test_base.cpp
+++ b/libwvdrmengine/cdm/core/test/test_base.cpp
@@ -198,8 +198,16 @@ bool TestCryptoSession::GenerateNonce(uint32_t* nonce) {
 
 class TestCryptoSessionFactory : public CryptoSessionFactory {
   CryptoSession* MakeCryptoSession(metrics::CryptoMetrics* crypto_metrics) {
+    // We need to add extra locking here because we need to make sure that there
+    // are no other OEMCrypto calls between OEMCrypto_Initialize and
+    // InstallTestRootOfTrust.  OEMCrypto_Initialize is called in the production
+    // CryptoSession::Init and is wrapped in crypto_lock_, but
+    // InstallTestRootOfTrust is only called in the constructor of the
+    // TestCryptoSession, above.
+    std::unique_lock<std::mutex> auto_lock(init_lock_);
     return new TestCryptoSession(crypto_metrics);
   }
+  std::mutex init_lock_;
 };
 
 void WvCdmTestBase::SetUp() {