diff --git a/jenkins/ci-pipelines/ci_stage_3.groovy b/jenkins/ci-pipelines/ci_stage_3.groovy
index d17d46e..7a92076 100644
--- a/jenkins/ci-pipelines/ci_stage_3.groovy
+++ b/jenkins/ci-pipelines/ci_stage_3.groovy
@@ -213,28 +213,29 @@
                     def upstreamComponent=""
                     if ( params.UPSTREAM_JOB_NAME ) {
                         println("Fetching upstream job artifact from ${params.UPSTREAM_JOB_NAME}")
+                        lock('Artifactory') {
+                            step ([$class: 'CopyArtifact',
+                                projectName: "${params.UPSTREAM_JOB_NAME}",
+                                selector: [$class: 'SpecificBuildSelector',
+                                buildNumber: "${params.UPSTREAM_JOB_NUMBER}"]
+                                ])
 
-                        step ([$class: 'CopyArtifact',
-                               projectName: "${params.UPSTREAM_JOB_NAME}",
-                               selector: [$class: 'SpecificBuildSelector',
-                               buildNumber: "${params.UPSTREAM_JOB_NUMBER}"]
-                              ])
+                            upstreamComponent = ci_helper.get_mdg_from_project(
+                                ci_helper.get_env_value('build.env','GERRIT_PROJECT'))
+                            def buildNumber = ci_helper.get_env_value('build.env','BUILD_NUMBER')
+                            dir("$upstreamComponent") {
+                                // the upstream job name contains suffix with the project. Need this stripped off
+                                def project_without_branch = params.UPSTREAM_JOB_NAME.split('/')[0]
+                                def packages = ci_helper.get_archive(params.ARTIFACTORY_SERVER,
+                                    upstreamComponent,
+                                    GERRIT_BRANCH,
+                                    "${project_without_branch} :: ${GERRIT_BRANCH}",
+                                    buildNumber)
 
-                        upstreamComponent = ci_helper.get_mdg_from_project(
-                            ci_helper.get_env_value('build.env','GERRIT_PROJECT'))
-                        def buildNumber = ci_helper.get_env_value('build.env','BUILD_NUMBER')
-                        dir("$upstreamComponent") {
-                            // the upstream job name contains suffix with the project. Need this stripped off
-                            def project_without_branch = params.UPSTREAM_JOB_NAME.split('/')[0]
-                            def packages = ci_helper.get_archive(params.ARTIFACTORY_SERVER,
-                                upstreamComponent,
-                                GERRIT_BRANCH,
-                                "${project_without_branch} :: ${GERRIT_BRANCH}",
-                                buildNumber)
-
-                            packageList.addAll(packages)
-                            println("Fetched pre-merge ${params.UPSTREAM_JOB_NAME}: ${packages}")
-                        }
+                                packageList.addAll(packages)
+                                println("Fetched pre-merge ${params.UPSTREAM_JOB_NAME}: ${packages}")
+                            }
+                        } // lock artifactory
                     }
 
                     parallelSteps = [:]
@@ -263,7 +264,9 @@
                             }
                         }
                     }
-                    parallel parallelSteps
+                    lock('Artifactory') {
+                        parallel parallelSteps
+                    }
 
 ///////////////////////////////////////////////////////////////////////////////////////
 // Create Devops APT repository