diff --git a/CMakeLists.txt b/CMakeLists.txt
index 8807f73..f6e065c 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -82,7 +82,7 @@ if(ENABLE_COVERAGE)
     add_custom_target(coverage
       COMMAND ${CMAKE_COMMAND} --build . --target all
       COMMAND ctest --output-on-failure
-      COMMAND ${LCOV_EXEC} --capture --directory ${CMAKE_BINARY_DIR} --output-file coverage.info --ignore-errors gcov,gcov
+      COMMAND ${LCOV_EXEC} --capture --directory ${CMAKE_BINARY_DIR} --output-file coverage.info --ignore-errors gcov,gcov --ignore-errors mismatch,mismatch
       COMMAND ${LCOV_EXEC} --remove coverage.info '/usr/*' --output-file coverage.filtered.info
       COMMAND ${GENHTML_EXEC} coverage.filtered.info --output-directory coverage-report
       WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
diff --git a/include/pool_allocator/pool_allocator.h b/include/pool_allocator/pool_allocator.h
index bcb4384..16fc972 100644
--- a/include/pool_allocator/pool_allocator.h
+++ b/include/pool_allocator/pool_allocator.h
@@ -40,6 +40,7 @@
 #include <cstddef>
 #include <iterator>
 #include <memory>
+#include <mutex>
 #include <utility>
 #include <vector>
 
@@ -253,9 +254,14 @@ class PoolAllocator : public pool_allocator_detail::ObjectOpsMixin<PoolAllocator
         return allocator.parent.bump_remaining();
     }
 
-    // Transfer free slots from another allocator
+    // Transfer free slots from another allocator.
+    // Locks this allocator's mutex (destination). The caller must be the owning
+    // thread of `from` (source) — no lock is taken on the source.
     void transfer_free(PoolAllocator<T, BlockSize>& from);
-    // Transfer all memory blocks and free slots from another allocator
+
+    // Transfer all memory blocks and free slots from another allocator.
+    // Locks this allocator's mutex (destination). The caller must be the owning
+    // thread of `from` (source) — no lock is taken on the source.
     void transfer_all(PoolAllocator<T, BlockSize>& from);
 
   private:
@@ -265,6 +271,11 @@ class PoolAllocator : public pool_allocator_detail::ObjectOpsMixin<PoolAllocator
 
     // No explicit export/import API; transfer functions call underlying allocator ops directly
     ComboAlloc allocator; // owns BlockAlloc internally and free list on top
+
+    // Mutex protecting this allocator as a transfer destination.
+    // Only locked by transfer_all/transfer_free on the destination side;
+    // the source is assumed to be accessed only by its owning thread.
+    mutable std::mutex transfer_mutex;
 };
 
 // Operators
diff --git a/include/pool_allocator/pool_allocator.tcc b/include/pool_allocator/pool_allocator.tcc
index 84c0f24..87785c7 100644
--- a/include/pool_allocator/pool_allocator.tcc
+++ b/include/pool_allocator/pool_allocator.tcc
@@ -337,6 +337,7 @@ void
 PoolAllocator<T, BlockSize>::transfer_all(PoolAllocator<T, BlockSize>& from)
 {
     assert(&from != this && "Cannot import directly from self");
+    std::lock_guard<std::mutex> lock(transfer_mutex);
     allocator.transfer_all(from.allocator);
 }
 
@@ -345,6 +346,7 @@ void
 PoolAllocator<T, BlockSize>::transfer_free(PoolAllocator<T, BlockSize>& from)
 {
     assert(&from != this && "Cannot import directly from self");
+    std::lock_guard<std::mutex> lock(transfer_mutex);
     allocator.transfer_free(from.allocator);
 }