diff --git a/apps/api/src/dkv/providers/imap.provider.ts b/apps/api/src/dkv/providers/imap.provider.ts
index a83dda8..f039b39 100644
--- a/apps/api/src/dkv/providers/imap.provider.ts
+++ b/apps/api/src/dkv/providers/imap.provider.ts
@@ -104,10 +104,14 @@ export class ImapProvider implements InboxProvider {
     const client = this.buildClient(config);
 
     await client.connect();
-    const lock = await client.getMailboxLock(config.folder || 'INBOX');
+    // lock is declared outside try so the type is available in finally, but
+    // getMailboxLock() itself is inside the try so that a lock failure still
+    // triggers client.logout() — preventing a connection leak (CR-03).
+    let lock: Awaited<ReturnType<typeof client.getMailboxLock>> | null = null;
     const results: InboxEmail[] = [];
 
     try {
+      lock = await client.getMailboxLock(config.folder || 'INBOX');
       // Search for emails from the configured sender
       const searchQuery = config.senderFilter
         ? { from: config.senderFilter }
@@ -170,7 +174,7 @@ export class ImapProvider implements InboxProvider {
         }
       }
     } finally {
-      lock.release();
+      lock?.release();
       await client.logout();
     }