diff --git a/base/src/core/include/core_env.h b/base/src/core/include/core_env.h
index 2646e3ad08..61342a04ec 100644
--- a/base/src/core/include/core_env.h
+++ b/base/src/core/include/core_env.h
@@ -77,7 +77,6 @@ namespace Genode {
 
 			void free(Ram_dataspace_capability ds)
 			{
-				Lock::Guard lock_guard(_lock);
 				RAM_SESSION_IMPL::free(ds);
 			}
 
diff --git a/base/src/core/include/ram_session_component.h b/base/src/core/include/ram_session_component.h
index d9609bf1d4..b9c87274e2 100644
--- a/base/src/core/include/ram_session_component.h
+++ b/base/src/core/include/ram_session_component.h
@@ -19,6 +19,7 @@
 #include <base/tslab.h>
 #include <base/rpc_server.h>
 #include <base/allocator_guard.h>
+#include <base/sync_allocator.h>
 
 /* core includes */
 #include <dataspace_component.h>
@@ -38,7 +39,7 @@ namespace Genode {
 
 			enum { SBS = 1024 };   /* slab block size */
 
-			typedef Tslab<Dataspace_component, SBS> Ds_slab;
+			typedef Synchronized_allocator<Tslab<Dataspace_component, SBS> > Ds_slab;
 
 			Rpc_entrypoint         *_ds_ep;
 			Rpc_entrypoint         *_ram_session_ep;
diff --git a/base/src/core/ram_session_component.cc b/base/src/core/ram_session_component.cc
index 97c6c0179f..ab4c4b6293 100644
--- a/base/src/core/ram_session_component.cc
+++ b/base/src/core/ram_session_component.cc
@@ -39,12 +39,12 @@ void Ram_session_component::_free_ds(Dataspace_component *ds)
 
 	size_t ds_size = ds->size();
 
-	/* destroy native shared memory representation */
-	_revoke_ram_ds(ds);
-
 	/* tell entry point to forget the dataspace */
 	_ds_ep->dissolve(ds);
 
+	/* destroy native shared memory representation */
+	_revoke_ram_ds(ds);
+
 	/* XXX: remove dataspace from all RM sessions */
 
 	/* free physical memory that was backing the dataspace */
@@ -54,6 +54,7 @@ void Ram_session_component::_free_ds(Dataspace_component *ds)
 	destroy(&_ds_slab, ds);
 
 	/* adjust payload */
+	Lock::Guard lock_guard(_ref_members_lock);
 	_payload -= ds_size;
 }
 
@@ -181,9 +182,6 @@ Ram_dataspace_capability Ram_session_component::alloc(size_t ds_size, bool cache
 	 */
 	_clear_ds(ds);
 
-	/* keep track of the used quota for actual payload */
-	_payload += ds_size;
-
 	if (verbose)
 		PDBG("ds_size=%zd, used_quota=%zd quota_limit=%zd",
 		     ds_size, used_quota(), _quota_limit);
@@ -193,6 +191,10 @@ Ram_dataspace_capability Ram_session_component::alloc(size_t ds_size, bool cache
 	/* create native shared memory representation of dataspace */
 	_export_ram_ds(ds);
 
+	Lock::Guard lock_guard(_ref_members_lock);
+	/* keep track of the used quota for actual payload */
+	_payload += ds_size;
+
 	return static_cap_cast<Ram_dataspace>(result);
 }
 
@@ -258,7 +260,7 @@ Ram_session_component::Ram_session_component(Rpc_entrypoint  *ds_ep,
 Ram_session_component::~Ram_session_component()
 {
 	/* destroy all dataspaces */
-	for (Dataspace_component *ds; (ds = _ds_slab.first_object()); _free_ds(ds));
+	for (Dataspace_component *ds; (ds = _ds_slab.raw()->first_object()); _free_ds(ds));
 
 	if (_payload != 0)
 		PWRN("Remaining payload of %zd in ram session to destroy", _payload);