but the services themselves do not need access to this lock, afaict