diff --git a/ctl_test.go b/ctl_test.go
index e767a68..9b4d1eb 100644
--- a/ctl_test.go
+++ b/ctl_test.go
@@ -450,8 +450,11 @@ func TestCtl(t *testing.T) {
 			defer msgf.Close()
 			_, err = msgf.Write(content)
 			tcheck(t, err, "write message file")
-			err = acc.DeliverMailbox(ctl.log, "Inbox", m, msgf)
-			tcheck(t, err, "deliver message")
+
+			acc.WithWLock(func() {
+				err = acc.DeliverMailbox(ctl.log, "Inbox", m, msgf)
+				tcheck(t, err, "deliver message")
+			})
 		}
 
 		var msgBadSize store.Message
diff --git a/imapserver/authenticate_test.go b/imapserver/authenticate_test.go
index 35e795c..c05b5d7 100644
--- a/imapserver/authenticate_test.go
+++ b/imapserver/authenticate_test.go
@@ -293,6 +293,8 @@ func TestAuthenticateTLSClientCert(t *testing.T) {
 	tcheck(t, err, "open account")
 	err = acc.SetPassword(pkglog, "test1234")
 	tcheck(t, err, "set password")
+	err = acc.Close()
+	tcheck(t, err, "close account")
 	tc = startArgsMore(t, true, true, nil, &clientConfig, false, true, true, "mjl", addClientCert)
 	tc.transactf("no", "authenticate plain %s", base64.StdEncoding.EncodeToString([]byte("\u0000other@mox.example\u0000test1234")))
 	tc.close()
diff --git a/smtpserver/server_test.go b/smtpserver/server_test.go
index 35dc15a..f125b16 100644
--- a/smtpserver/server_test.go
+++ b/smtpserver/server_test.go
@@ -646,10 +646,11 @@ func tinsertmsg(t *testing.T, acc *store.Account, mailbox string, m *store.Messa
 	defer mf.Close()
 	_, err = mf.Write([]byte(msg))
 	tcheck(t, err, "write message")
-	err = acc.DeliverMailbox(pkglog, mailbox, m, mf)
-	tcheck(t, err, "deliver message")
-	err = mf.Close()
-	tcheck(t, err, "close message")
+
+	acc.WithWLock(func() {
+		err = acc.DeliverMailbox(pkglog, mailbox, m, mf)
+		tcheck(t, err, "deliver message")
+	})
 }
 
 func tretrain(t *testing.T, acc *store.Account) {
diff --git a/store/export_test.go b/store/export_test.go
index 14d0432..06afbca 100644
--- a/store/export_test.go
+++ b/store/export_test.go
@@ -41,13 +41,15 @@ func TestExport(t *testing.T) {
 	_, err = msgFile.Write([]byte(msg))
 	tcheck(t, err, "write message")
 
-	m := Message{Received: time.Now(), Size: int64(len(msg))}
-	err = acc.DeliverMailbox(pkglog, "Inbox", &m, msgFile)
-	tcheck(t, err, "deliver")
+	acc.WithWLock(func() {
+		m := Message{Received: time.Now(), Size: int64(len(msg))}
+		err = acc.DeliverMailbox(pkglog, "Inbox", &m, msgFile)
+		tcheck(t, err, "deliver")
 
-	m = Message{Received: time.Now(), Size: int64(len(msg))}
-	err = acc.DeliverMailbox(pkglog, "Trash", &m, msgFile)
-	tcheck(t, err, "deliver")
+		m = Message{Received: time.Now(), Size: int64(len(msg))}
+		err = acc.DeliverMailbox(pkglog, "Trash", &m, msgFile)
+		tcheck(t, err, "deliver")
+	})
 
 	var maildirZip, maildirTar, mboxZip, mboxTar bytes.Buffer
 
diff --git a/store/threads_test.go b/store/threads_test.go
index c0127af..ac1c8d9 100644
--- a/store/threads_test.go
+++ b/store/threads_test.go
@@ -42,8 +42,11 @@ func TestThreadingUpgrade(t *testing.T) {
 			MsgPrefix: []byte(s),
 			Received:  recv,
 		}
-		err = acc.DeliverMailbox(log, "Inbox", &m, f)
-		tcheck(t, err, "deliver")
+		acc.WithWLock(func() {
+			err = acc.DeliverMailbox(log, "Inbox", &m, f)
+			tcheck(t, err, "deliver")
+		})
+
 		if expThreadID == 0 {
 			expThreadID = m.ID
 		}
diff --git a/webmail/webmail_test.go b/webmail/webmail_test.go
index fcd07b8..d90ca3e 100644
--- a/webmail/webmail_test.go
+++ b/webmail/webmail_test.go
@@ -264,28 +264,30 @@ type testmsg struct {
 }
 
 func tdeliver(t *testing.T, acc *store.Account, tm *testmsg) {
-	msgFile, err := store.CreateMessageTemp(pkglog, "webmail-test")
-	tcheck(t, err, "create message temp")
-	defer os.Remove(msgFile.Name())
-	defer msgFile.Close()
-	size, err := msgFile.Write(tm.msg.Marshal(t))
-	tcheck(t, err, "write message temp")
-	m := store.Message{
-		Flags:            tm.Flags,
-		RcptToLocalpart:  "mox",
-		RcptToDomain:     "other.example",
-		MsgFromLocalpart: "mjl",
-		MsgFromDomain:    "mox.example",
-		DKIMDomains:      []string{"mox.example"},
-		Keywords:         tm.Keywords,
-		Size:             int64(size),
-	}
-	err = acc.DeliverMailbox(pkglog, tm.Mailbox, &m, msgFile)
-	tcheck(t, err, "deliver test message")
-	err = msgFile.Close()
-	tcheck(t, err, "closing test message")
-	tm.m = m
-	tm.ID = m.ID
+	acc.WithWLock(func() {
+		msgFile, err := store.CreateMessageTemp(pkglog, "webmail-test")
+		tcheck(t, err, "create message temp")
+		defer os.Remove(msgFile.Name())
+		defer msgFile.Close()
+		size, err := msgFile.Write(tm.msg.Marshal(t))
+		tcheck(t, err, "write message temp")
+		m := store.Message{
+			Flags:            tm.Flags,
+			RcptToLocalpart:  "mox",
+			RcptToDomain:     "other.example",
+			MsgFromLocalpart: "mjl",
+			MsgFromDomain:    "mox.example",
+			DKIMDomains:      []string{"mox.example"},
+			Keywords:         tm.Keywords,
+			Size:             int64(size),
+		}
+		err = acc.DeliverMailbox(pkglog, tm.Mailbox, &m, msgFile)
+		tcheck(t, err, "deliver test message")
+		err = msgFile.Close()
+		tcheck(t, err, "closing test message")
+		tm.m = m
+		tm.ID = m.ID
+	})
 }
 
 func readBody(r io.Reader) string {
diff --git a/webops/xops.go b/webops/xops.go
index c346097..9610c66 100644
--- a/webops/xops.go
+++ b/webops/xops.go
@@ -358,7 +358,7 @@ func (x XOps) MailboxesMarkRead(ctx context.Context, log mlog.Log, acc *store.Ac
 
 // MessageMove moves messages to the mailbox represented by mailboxName, or to mailboxID if mailboxName is empty.
 func (x XOps) MessageMove(ctx context.Context, log mlog.Log, acc *store.Account, messageIDs []int64, mailboxName string, mailboxID int64) {
-	acc.WithRLock(func() {
+	acc.WithWLock(func() {
 		var changes []store.Change
 
 		x.DBWrite(ctx, acc, func(tx *bstore.Tx) {