diff --git a/CHANGES b/CHANGES
index 008eb57119..35c751348d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,9 @@
+6125.	[bug]		Hold a catz reference while the update process is
+			running, so that the catalog zone is not destroyed
+			during shutdown until the update process is finished or
+			properly canceled by the activated 'shuttingdown' flag.
+			[GL #3955]
+
 6124.	[bug]		When changing from a NSEC3 capable DNSSEC algorithm to
 			an NSEC3 incapable DNSSEC algorithm using KASP the zone
 			could sometimes be incompletely signed. [GL #3937]
diff --git a/lib/dns/catz.c b/lib/dns/catz.c
index 73d30b62a0..58cd369312 100644
--- a/lib/dns/catz.c
+++ b/lib/dns/catz.c
@@ -2124,6 +2124,7 @@ dns__catz_timer_cb(void *arg) {
 		      ISC_LOG_INFO, "catz: %s: reload start", domain);
 
 	dns_catz_ref_catzs(catz->catzs);
+	dns_catz_ref_catz(catz);
 	isc_work_enqueue(catz->loop, dns__catz_update_cb, dns__catz_done_cb,
 			 catz);
 
@@ -2543,6 +2544,7 @@ dns__catz_done_cb(void *data) {
 		      ISC_LOG_INFO, "catz: %s: reload done: %s", dname,
 		      isc_result_totext(catz->updateresult));
 
+	dns_catz_unref_catz(catz);
 	dns_catz_unref_catzs(catz->catzs);
 }