diff --git a/modules/openstack_project/manifests/mariadb_mirror.pp b/modules/openstack_project/manifests/mariadb_mirror.pp
index 53501a8f32..2f1b18ac03 100644
--- a/modules/openstack_project/manifests/mariadb_mirror.pp
+++ b/modules/openstack_project/manifests/mariadb_mirror.pp
@@ -11,11 +11,15 @@ define openstack_project::mariadb_mirror (
     releases      => [ 'trusty', 'xenial' ],
   }
 
+  # NOTE(ianw) we have several versions, but they all share the same
+  # mirror.ubuntu-mariadb volume.  Start them at offset times, but
+  # also share the lock so that one doesn't release the volume when
+  # the other is half-complete.
   cron { "reprepro ubuntu mariadb $name":
     user        => $user,
     hour        => '*/2',
-    minute      => '0',
-    command     => "flock -n /var/run/reprepro/ubuntu-mariadb-$name.lock reprepro-mirror-update /etc/reprepro/ubuntu-mariadb-$name mirror.ubuntu-mariadb-$name >>/var/log/reprepro/ubuntu-mariadb-$name-mirror.log 2>&1",
+    minute      => fqdn_rand(30, $name),
+    command     => "flock -w 3600 /var/run/reprepro/ubuntu-mariadb.lock reprepro-mirror-update /etc/reprepro/ubuntu-mariadb-$name mirror.ubuntu-mariadb >>/var/log/reprepro/ubuntu-mariadb-$name-mirror.log 2>&1",
     environment => 'PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin',
   }
 }