diff --git a/libnetwork/agent.go b/libnetwork/agent.go
index 5a7e028cd6..3265add3cb 100644
--- a/libnetwork/agent.go
+++ b/libnetwork/agent.go
@@ -328,7 +328,10 @@ func (c *controller) agentClose() {
 	c.agent.epTblCancel()
 
 	c.agent.networkDB.Close()
+
+	c.Lock()
 	c.agent = nil
+	c.Unlock()
 }
 
 func (n *network) isClusterEligible() bool {
diff --git a/libnetwork/controller.go b/libnetwork/controller.go
index f7997b94c9..3d7382bd36 100644
--- a/libnetwork/controller.go
+++ b/libnetwork/controller.go
@@ -307,13 +307,16 @@ func (c *controller) clusterAgentInit() {
 			c.Lock()
 			c.clusterConfigAvailable = false
 			c.agentInitDone = make(chan struct{})
+			c.keys = nil
 			c.Unlock()
 
 			if err := c.ingressSandbox.Delete(); err != nil {
 				log.Warnf("Could not delete ingress sandbox while leaving: %v", err)
 			}
 
+			c.Lock()
 			c.ingressSandbox = nil
+			c.Unlock()
 
 			n, err := c.NetworkByName("ingress")
 			if err != nil {