diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 140c91a302..9beab17988 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -124,7 +124,7 @@ struct signer_event {
 
 static dns_dnsseckeylist_t keylist;
 static unsigned int keycount = 0;
-isc_rwlock_t keylist_lock;
+static isc_rwlock_t keylist_lock;
 static isc_stdtime_t starttime = 0, endtime = 0, dnskey_endtime = 0, now;
 static int cycle = -1;
 static int jitter = 0;
@@ -383,9 +383,9 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	dst_key_t *pubkey = NULL, *privkey = NULL;
 	dns_dnsseckey_t *key = NULL;
 
-	isc_rwlock_lock(&keylist_lock, isc_rwlocktype_read);
+	RWLOCK(&keylist_lock, isc_rwlocktype_read);
 	key = keythatsigned_unlocked(rrsig);
-	isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_read);
+	RWUNLOCK(&keylist_lock, isc_rwlocktype_read);
 	if (key != NULL) {
 		return (key);
 	}
diff --git a/lib/isc/rwlock.c b/lib/isc/rwlock.c
index 3441ce5c14..17bebda90e 100644
--- a/lib/isc/rwlock.c
+++ b/lib/isc/rwlock.c
@@ -113,9 +113,12 @@ isc_rwlock_tryupgrade(isc_rwlock_t *rwl) {
 
 void
 isc_rwlock_downgrade(isc_rwlock_t *rwl) {
+	isc_result_t result;
 	atomic_store_release(&rwl->downgrade, true);
-	isc_rwlock_unlock(rwl, isc_rwlocktype_write);
-	isc_rwlock_lock(rwl, isc_rwlocktype_read);
+	result = isc_rwlock_unlock(rwl, isc_rwlocktype_write);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	result = isc_rwlock_lock(rwl, isc_rwlocktype_read);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	atomic_store_release(&rwl->downgrade, false);
 }