diff --git a/hack/vendor.sh b/hack/vendor.sh
index aac0706e186b9274be8e359b666a258f55f5da2f..8dc659b6bbcbfe7a202d7e19832b47ce11ee98f3 100755
--- a/hack/vendor.sh
+++ b/hack/vendor.sh
@@ -48,7 +48,7 @@ esac
 
 # the following lines are in sorted order, FYI
 clone git github.com/Azure/go-ansiterm 388960b655244e76e24c75f48631564eaefade62
-clone git github.com/Microsoft/hcsshim v0.5.1
+clone git github.com/Microsoft/hcsshim v0.5.2
 clone git github.com/Microsoft/go-winio v0.3.5
 clone git github.com/Sirupsen/logrus f76d643702a30fbffecdfe50831e11881c96ceb3 https://github.com/aaronlehmann/logrus
 clone git github.com/docker/libtrust 9cbd2a1374f46905c68a4eb3694a130610adc62a
diff --git a/vendor/src/github.com/Microsoft/hcsshim/hcsshim.go b/vendor/src/github.com/Microsoft/hcsshim/hcsshim.go
index cd90a40b670a8abf2eda0a615db98584ce079e11..3cb3a299ff4ba32944a25e7b2d95d7bb2920fc38 100644
--- a/vendor/src/github.com/Microsoft/hcsshim/hcsshim.go
+++ b/vendor/src/github.com/Microsoft/hcsshim/hcsshim.go
@@ -1,4 +1,4 @@
-// Shim for the Host Compute Service (HSC) to manage Windows Server
+// Shim for the Host Compute Service (HCS) to manage Windows Server
 // containers and Hyper-V containers.
 
 package hcsshim
diff --git a/vendor/src/github.com/Microsoft/hcsshim/hnsfuncs.go b/vendor/src/github.com/Microsoft/hcsshim/hnsfuncs.go
index 7bf46a6881f250ab05d293e4d5f7a7c64b021a3c..57ad5198917180fc93948de2bd02756a37bbc0c0 100644
--- a/vendor/src/github.com/Microsoft/hcsshim/hnsfuncs.go
+++ b/vendor/src/github.com/Microsoft/hcsshim/hnsfuncs.go
@@ -30,6 +30,11 @@ type VsidPolicy struct {
 	VSID uint
 }
 
+type PaPolicy struct {
+	Type string
+	PA   string
+}
+
 // Subnet is assoicated with a network and represents a list
 // of subnets available to the network
 type Subnet struct {
@@ -58,6 +63,7 @@ type HNSNetwork struct {
 	DNSSuffix            string            `json:",omitempty"`
 	DNSServerList        string            `json:",omitempty"`
 	DNSServerCompartment uint32            `json:",omitempty"`
+	ManagementIP         string            `json:",omitempty"`
 }
 
 // HNSEndpoint represents a network endpoint in HNS
@@ -74,6 +80,7 @@ type HNSEndpoint struct {
 	GatewayAddress     string            `json:",omitempty"`
 	EnableInternalDNS  bool              `json:",omitempty"`
 	PrefixLength       uint8             `json:",omitempty"`
+	IsRemoteEndpoint   bool              `json:",omitempty"`
 }
 
 type hnsNetworkResponse struct {
diff --git a/vendor/src/github.com/Microsoft/hcsshim/preparelayer.go b/vendor/src/github.com/Microsoft/hcsshim/preparelayer.go
index 69b5fe045ef9e0322902914ff938cbc47b7a19d9..27916834676eaa9974630d00aca8d6b521581320 100644
--- a/vendor/src/github.com/Microsoft/hcsshim/preparelayer.go
+++ b/vendor/src/github.com/Microsoft/hcsshim/preparelayer.go
@@ -1,6 +1,12 @@
 package hcsshim
 
-import "github.com/Sirupsen/logrus"
+import (
+	"sync"
+
+	"github.com/Sirupsen/logrus"
+)
+
+var prepareLayerLock sync.Mutex
 
 // PrepareLayer finds a mounted read-write layer matching layerId and enables the
 // the filesystem filter for use on that layer.  This requires the paths to all
@@ -24,6 +30,10 @@ func PrepareLayer(info DriverInfo, layerId string, parentLayerPaths []string) er
 		return err
 	}
 
+	// This lock is a temporary workaround for a Windows bug. Only allowing one
+	// call to prepareLayer at a time vastly reduces the chance of a timeout.
+	prepareLayerLock.Lock()
+	defer prepareLayerLock.Unlock()
 	err = prepareLayer(&infop, layerId, layers)
 	if err != nil {
 		err = makeErrorf(err, title, "layerId=%s flavour=%d", layerId, info.Flavour)