diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7b88b2ee16823b7af094318eae105ac3d74e203d..ea04e3d39c10cf93110dab1961be91e33fd465d1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@ The format is based on [keep a changelog](http://keepachangelog.com) and this pr
 ### Fixed
 - Set gateway timeout to match idle timeout value.
 - Reliably release database resources before moving from one query to the next.
+- Unlock GPGS certs cache in social client.
 
 ## [2.3.1] - 2019-01-04
 ### Added
diff --git a/social/social.go b/social/social.go
index 75b051731d01c2afdf19283dd634ac7f717407ab..d552ae5935ce4544feba406a501ebbe085cc0c30 100644
--- a/social/social.go
+++ b/social/social.go
@@ -267,10 +267,10 @@ func (c *Client) CheckGoogleToken(ctx context.Context, idToken string) (*GoogleP
 			break
 		}
 	}
+	c.RUnlock()
 
 	// All verification attempts failed.
 	if token == nil {
-		c.RUnlock()
 		return nil, errors.New("google id token invalid")
 	}