diff --git a/cmix/gateway/hostPool.go b/cmix/gateway/hostPool.go
index 25dc7192ed9933dcf323190a526c772a1548e8a3..71fcbe1870091471132b2efbc2cb426d68d70735 100644
--- a/cmix/gateway/hostPool.go
+++ b/cmix/gateway/hostPool.go
@@ -358,16 +358,16 @@ func (h *HostPool) UpdateNdf(ndf *ndf.NetworkDefinition) {
 		return
 	}
 
+	// Lock order is extremely important here
+	h.hostMux.Lock()
 	h.ndfMux.Lock()
 	h.ndf = ndf.DeepCopy()
-
-	h.hostMux.Lock()
 	err := h.updateConns()
-	h.hostMux.Unlock()
 	if err != nil {
 		jww.ERROR.Printf("Unable to updateConns: %+v", err)
 	}
 	h.ndfMux.Unlock()
+	h.hostMux.Unlock()
 }
 
 // SetGatewayFilter sets the filter used to filter gateways from the ID map.
@@ -506,8 +506,9 @@ func (h *HostPool) checkReplace(hostId *id.ID, hostErr error) (bool, error) {
 		}
 	}
 
+	// If the Host is still in the pool
 	if doReplace {
-		// If the Host is still in the pool
+		// Lock order is extremely important here
 		h.hostMux.Lock()
 		if oldPoolIndex, ok := h.hostMap[*hostId]; ok {
 			// Replace it