diff --git a/ee/tpmrunner/tpmrunner.go b/ee/tpmrunner/tpmrunner.go
index 02190c105..ec4befddc 100644
--- a/ee/tpmrunner/tpmrunner.go
+++ b/ee/tpmrunner/tpmrunner.go
@@ -193,12 +193,12 @@ func clearKeyData(slogger *slog.Logger, deleter types.Deleter) {
 }
 
 func (tr *tpmRunner) loadOrCreateKeys(ctx context.Context) error {
-	tr.mux.Lock()
-	defer tr.mux.Unlock()
-
 	ctx, span := traces.StartSpan(ctx)
 	defer span.End()
 
+	tr.mux.Lock()
+	defer tr.mux.Unlock()
+
 	priData, pubData, err := fetchKeyData(tr.store)
 	if err != nil {
 		thisErr := fmt.Errorf("fetching key data for data store: %w", err)