diff --git a/pkg/tcpip/stack/BUILD b/pkg/tcpip/stack/BUILD
index a380d5b26..81d3e1168 100644
--- a/pkg/tcpip/stack/BUILD
+++ b/pkg/tcpip/stack/BUILD
@@ -112,6 +112,7 @@ declare_rwmutex(
 declare_rwmutex(
     name = "bucket_mutex",
     out = "bucket_mutex.go",
+    nested_lock_names = ["otherTuple"],
     package = "stack",
     prefix = "bucket",
 )
diff --git a/pkg/tcpip/stack/conntrack.go b/pkg/tcpip/stack/conntrack.go
index 0618d899b..95e11ac47 100644
--- a/pkg/tcpip/stack/conntrack.go
+++ b/pkg/tcpip/stack/conntrack.go
@@ -1097,9 +1097,9 @@ func (ct *ConnTrack) reapTupleLocked(reapingTuple *tuple, bktID int, bkt *bucket
 		bkt.tuples.Remove(otherTuple)
 	} else {
 		otherTupleBkt := &ct.buckets[otherTupleBktID]
-		otherTupleBkt.mu.Lock()
+		otherTupleBkt.mu.NestedLock(bucketLockOthertuple)
 		otherTupleBkt.tuples.Remove(otherTuple)
-		otherTupleBkt.mu.Unlock()
+		otherTupleBkt.mu.NestedUnlock(bucketLockOthertuple)
 	}
 
 	return true