diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4a47b9b..bb77aee 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
     name: rustfmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v5
       - uses: sfackler/actions/rustup@master
       - uses: sfackler/actions/rustfmt@master
 
@@ -32,25 +32,25 @@ jobs:
     name: test-${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v5
       - uses: sfackler/actions/rustup@master
         with:
           version: 1.80.0
       - run: echo "::set-output name=version::$(rustc --version)"
         id: rust-version
-      - uses: actions/cache@v1
+      - uses: actions/cache@v4
         with:
           path: ~/.cargo/registry/index
           key: index-${{ runner.os }}-${{ github.run_number }}
           restore-keys: |
             index-${{ runner.os }}-
       - run: cargo generate-lockfile
-      - uses: actions/cache@v1
+      - uses: actions/cache@v4
         with:
           path: ~/.cargo/registry/cache
           key: registry-${{ runner.os }}-${{ steps.rust-version.outputs.version }}-${{ hashFiles('Cargo.lock') }}
       - run: cargo fetch
-      - uses: actions/cache@v1
+      - uses: actions/cache@v4
         with:
           path: target
           key: target-${{ runner.os }}-${{ steps.rust-version.outputs.version }}-${{ hashFiles('Cargo.lock') }}
diff --git a/src/imp/security_framework.rs b/src/imp/security_framework.rs
index 302791a..a95e3ab 100644
--- a/src/imp/security_framework.rs
+++ b/src/imp/security_framework.rs
@@ -199,9 +199,12 @@ impl Identity {
             }
         });
 
-        let keychain = match *TEMP_KEYCHAIN.lock().unwrap() {
-            Some((ref keychain, _)) => keychain.clone(),
-            ref mut lock @ None => {
+        // keep it locked during import()
+        let keychain = &mut *TEMP_KEYCHAIN.lock().unwrap();
+
+        let keychain = match keychain {
+            Some((keychain, _)) => keychain.clone(),
+            lock @ None => {
                 let dir =
                     tempfile::TempDir::new().map_err(|_| Error(base::Error::from(errSecIO)))?;