diff --git a/Makefile b/Makefile
index 65098c3f..59931eb5 100644
--- a/Makefile
+++ b/Makefile
@@ -33,7 +33,7 @@ generate-%: controller-gen
 # Run tests
 KUBEBUILDER_ASSETS?="$(shell $(ENVTEST) --arch=$(ENVTEST_ARCH) use -i $(ENVTEST_KUBERNETES_VERSION) --bin-dir=$(ENVTEST_ASSETS_DIR) -p path)"
 test-%: tidy-% generate-% fmt-% vet-% install-envtest
-	cd $(subst :,/,$*); KUBEBUILDER_ASSETS=$(KUBEBUILDER_ASSETS) go test ./... -coverprofile cover.out
+	cd $(subst :,/,$*); KUBEBUILDER_ASSETS=$(KUBEBUILDER_ASSETS) go test ./... -race -coverprofile cover.out
 
 release-%:
 	$(eval REL_PATH=$(subst :,/,$*))
diff --git a/gittestserver/server.go b/gittestserver/server.go
index 4edec10f..917b872e 100644
--- a/gittestserver/server.go
+++ b/gittestserver/server.go
@@ -25,6 +25,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"sync"
 	"time"
 
 	"github.com/go-git/go-billy/v5/memfs"
@@ -36,6 +37,8 @@ import (
 	"github.com/sosedoff/gitkit"
 )
 
+var m sync.RWMutex
+
 // NewTempGitServer returns a GitServer with a newly created temp
 // dir as repository docroot.
 func NewTempGitServer() (*GitServer, error) {
@@ -188,12 +191,20 @@ func (s *GitServer) StopHTTP() {
 // unlike StartSSH(), and the server URL is available with
 // SSHAddress() after calling this.
 func (s *GitServer) ListenSSH() error {
-	if s.sshServer == nil {
+	m.RLock()
+	sshServer := s.sshServer
+	m.RUnlock()
+
+	if sshServer == nil {
+		m.Lock()
+		defer m.Unlock()
 		s.sshServer = gitkit.NewSSH(s.config)
+
 		// This is where authentication would happen, when needed.
 		s.sshServer.PublicKeyLookupFunc = func(content string) (*gitkit.PublicKey, error) {
 			return &gitkit.PublicKey{Id: "test-user"}, nil
 		}
+
 		// :0 should result in an OS assigned free port; 127.0.0.1
 		// forces the lowest common denominator of TCPv4 on localhost.
 		return s.sshServer.Listen("127.0.0.1:0")
@@ -216,8 +227,12 @@ func (s *GitServer) StartSSH() error {
 
 // StopSSH stops the SSH git server.
 func (s *GitServer) StopSSH() error {
-	if s.sshServer != nil {
-		return s.sshServer.Stop()
+	m.RLock()
+	sshServer := s.sshServer
+	m.RUnlock()
+
+	if sshServer != nil {
+		return sshServer.Stop()
 	}
 	return nil
 }