diff --git a/.pnp.cjs b/.pnp.cjs
index 062aa0f7409..f2c82efb91a 100755
--- a/.pnp.cjs
+++ b/.pnp.cjs
@@ -9698,6 +9698,7 @@ const RAW_RUNTIME_STATE =
           ["oclif", "npm:4.0.3"],\
           ["pretty-bytes", "npm:5.6.0"],\
           ["pretty-ms", "npm:7.0.1"],\
+          ["proper-lockfile", "npm:4.1.2"],\
           ["public-ip", "npm:6.0.1"],\
           ["qs", "npm:6.15.0"],\
           ["rxjs", "npm:6.6.7"],\
@@ -9707,7 +9708,8 @@ const RAW_RUNTIME_STATE =
           ["systeminformation", "npm:5.31.1"],\
           ["table", "npm:6.8.1"],\
           ["tar", "npm:7.5.10"],\
-          ["wrap-ansi", "npm:7.0.0"]\
+          ["wrap-ansi", "npm:7.0.0"],\
+          ["write-file-atomic", "npm:5.0.1"]\
         ],\
         "linkType": "SOFT"\
       }]\
@@ -18295,6 +18297,16 @@ const RAW_RUNTIME_STATE =
           ["signal-exit", "npm:3.0.7"]\
         ],\
         "linkType": "HARD"\
+      }],\
+      ["npm:4.1.2", {\
+        "packageLocation": "./.yarn/cache/proper-lockfile-npm-4.1.2-a140a3c928-000a4875f5.zip/node_modules/proper-lockfile/",\
+        "packageDependencies": [\
+          ["graceful-fs", "npm:4.2.10"],\
+          ["proper-lockfile", "npm:4.1.2"],\
+          ["retry", "npm:0.12.0"],\
+          ["signal-exit", "npm:3.0.7"]\
+        ],\
+        "linkType": "HARD"\
       }]\
     ]],\
     ["protobufjs", [\
@@ -23536,6 +23548,15 @@ const RAW_RUNTIME_STATE =
           ["write-file-atomic", "npm:4.0.1"]\
         ],\
         "linkType": "HARD"\
+      }],\
+      ["npm:5.0.1", {\
+        "packageLocation": "./.yarn/cache/write-file-atomic-npm-5.0.1-52283db6ee-648efddba5.zip/node_modules/write-file-atomic/",\
+        "packageDependencies": [\
+          ["imurmurhash", "npm:0.1.4"],\
+          ["signal-exit", "npm:4.1.0"],\
+          ["write-file-atomic", "npm:5.0.1"]\
+        ],\
+        "linkType": "HARD"\
       }]\
     ]],\
     ["ws", [\
diff --git a/.yarn/cache/proper-lockfile-npm-4.1.2-a140a3c928-000a4875f5.zip b/.yarn/cache/proper-lockfile-npm-4.1.2-a140a3c928-000a4875f5.zip
new file mode 100644
index 00000000000..a7389ae2254
Binary files /dev/null and b/.yarn/cache/proper-lockfile-npm-4.1.2-a140a3c928-000a4875f5.zip differ
diff --git a/.yarn/cache/write-file-atomic-npm-5.0.1-52283db6ee-648efddba5.zip b/.yarn/cache/write-file-atomic-npm-5.0.1-52283db6ee-648efddba5.zip
new file mode 100644
index 00000000000..4b1680c8f31
Binary files /dev/null and b/.yarn/cache/write-file-atomic-npm-5.0.1-52283db6ee-648efddba5.zip differ
diff --git a/packages/dashmate/docs/config/index.md b/packages/dashmate/docs/config/index.md
index a81ac218c61..b2868a530d6 100644
--- a/packages/dashmate/docs/config/index.md
+++ b/packages/dashmate/docs/config/index.md
@@ -179,3 +179,52 @@ dashmate config get <option>
 # Enable debug logging
 dashmate config set core.log.debug.enabled true
 ```
+
+## Running Dashmate commands concurrently
+
+Dashmate keeps all configuration in a single `config.json` inside its home directory
+(`~/.dashmate` by default), and a command that changes configuration rewrites that whole
+file when it exits.
+
+To keep two overlapping commands from silently reverting each other, a command refuses to
+save when `config.json` changed on disk after that command loaded it:
+
+```text
+'/home/user/.dashmate/config.json' was modified by another process after this command
+loaded it. Refusing to overwrite it. The changes from this command were saved to
+'/home/user/.dashmate/config.json.rejected-2026-07-28T09-14-22-031Z-4711-1' so you can
+reconcile them.
+```
+
+The command exits non-zero and the other process's change is kept. Nothing is lost — the
+configuration this command wanted to save is written to the `.rejected-*` file named in
+the message, so you can compare it and reapply what you need. These files are never
+cleaned up automatically; remove them once you have reconciled them.
+
+How to respond depends on the command:
+
+- `dashmate config set` — reload and run it again. Nothing else happened.
+- `dashmate config create`, `remove`, `default` — re-check your assumptions before
+  retrying. The other process may have created or removed the very configuration you were
+  operating on.
+- `dashmate setup`, `reset`, `start`, `ssl obtain` — **the operational work already
+  happened**; only saving the configuration failed. Containers may be running and
+  certificates may have been issued. Reconcile from the `.rejected-*` file rather than
+  simply re-running the command.
+
+Read-only commands such as `dashmate config get`, `dashmate status` and `dashmate core
+cli` never write configuration and are always safe to run alongside anything else.
+
+### Limits of this guarantee
+
+- **All Dashmate instances must be on a version that has this behaviour.** The
+  coordination is cooperative, so an older Dashmate process — including a long-running
+  helper started before an upgrade — can still overwrite a newer one. After upgrading,
+  restart the node so the helper restarts too.
+- **Local filesystems only.** The guarantee is not claimed for a Dashmate home directory
+  on NFS or another network filesystem.
+- **Only Dashmate processes take part in this.** A hand edit made while a long Dashmate
+  command is running is usually detected and the command refuses rather than discarding it
+  — but a text editor does not take the lock, so an edit saved in the moment between
+  Dashmate re-reading the file and replacing it can still be overwritten. Stop Dashmate
+  commands before editing `config.json` by hand if the edit matters.
diff --git a/packages/dashmate/package.json b/packages/dashmate/package.json
index 6ed77abc9a8..ef87ee31750 100644
--- a/packages/dashmate/package.json
+++ b/packages/dashmate/package.json
@@ -87,6 +87,7 @@
     "node-graceful": "^3.0.1",
     "pretty-bytes": "^5.3.0",
     "pretty-ms": "^7.0.0",
+    "proper-lockfile": "^4.1.2",
     "public-ip": "^6.0.1",
     "qs": "^6.14.2",
     "rxjs": "^6.6.7",
@@ -94,7 +95,8 @@
     "systeminformation": "^5.31.1",
     "table": "^6.8.1",
     "tar": "7.5.10",
-    "wrap-ansi": "^7.0.0"
+    "wrap-ansi": "^7.0.0",
+    "write-file-atomic": "^5.0.1"
   },
   "devDependencies": {
     "@babel/core": "^7.26.10",
diff --git a/packages/dashmate/scripts/helper.js b/packages/dashmate/scripts/helper.js
index 484a67558a8..4fa8bdf7d64 100644
--- a/packages/dashmate/scripts/helper.js
+++ b/packages/dashmate/scripts/helper.js
@@ -94,11 +94,14 @@ async function removeOrphanedSslContainers(docker) {
 
   // Persist config if it was migrated
   if (configFile.isChanged()) {
+    // Captured before the write, which clears these flags once the new state is
+    // on disk.
+    const changedConfigs = configFile.getAllConfigs()
+      .filter((config) => config.isChanged());
+
     await configFileRepository.write(configFile);
 
-    configFile.getAllConfigs()
-      .filter((config) => config.isChanged())
-      .forEach(writeConfigTemplates);
+    changedConfigs.forEach(writeConfigTemplates);
   }
 
   const config = configFile.getConfig(configName);
diff --git a/packages/dashmate/src/config/Config.js b/packages/dashmate/src/config/Config.js
index 7e13e6e8a8b..a84978f5c96 100644
--- a/packages/dashmate/src/config/Config.js
+++ b/packages/dashmate/src/config/Config.js
@@ -39,9 +39,15 @@ export default class Config {
     assertSafeConfigName(name);
 
     this.name = name;
-    this.changed = false;
 
     this.setOptions(options, skipValidation);
+
+    // Hydration is not a mutation. setOptions() marks the config changed because
+    // it is a genuine edit when called on an existing config, but a config that
+    // was just loaded has nothing unsaved. Callers that build a config which must
+    // reach disk - the default set for a new config file, createConfig() - mark it
+    // changed themselves.
+    this.changed = false;
   }
 
   /**
diff --git a/packages/dashmate/src/config/configFile/ConfigFileJsonRepository.js b/packages/dashmate/src/config/configFile/ConfigFileJsonRepository.js
index 528fedf3fd2..04e325ef167 100644
--- a/packages/dashmate/src/config/configFile/ConfigFileJsonRepository.js
+++ b/packages/dashmate/src/config/configFile/ConfigFileJsonRepository.js
@@ -1,14 +1,75 @@
 import fs from 'fs';
 import Ajv from 'ajv';
 import path from 'path';
+import lockfile from 'proper-lockfile';
+import writeFileAtomic from 'write-file-atomic';
 import Config from '../Config.js';
 import { PACKAGE_ROOT_DIR } from '../../constants.js';
 import ConfigFileNotFoundError from '../errors/ConfigFileNotFoundError.js';
 import InvalidConfigFileFormatError from '../errors/InvalidConfigFileFormatError.js';
+import ConfigFileConflictError from '../errors/ConfigFileConflictError.js';
 import configFileJsonSchema from './configFileJsonSchema.js';
 import ConfigFile from './ConfigFile.js';
 
+/**
+ * How long a lock may go un-refreshed before another process may break it.
+ * Comfortably longer than the milliseconds the lock is actually held, so a busy
+ * event loop cannot get its live lock stolen, but short enough that a process
+ * killed while holding it does not block the next command for long.
+ */
+const LOCK_STALE_MS = 10000;
+
+/**
+ * Waiting is synchronous, which means signal handlers do not run while it is in
+ * progress. Kept just above the stale threshold - long enough to outlast a dead
+ * holder's lock, short enough that Ctrl-C is never ignored for long.
+ */
+const LOCK_ACQUIRE_TIMEOUT_MS = LOCK_STALE_MS + 2000;
+
+const LOCK_RETRY_INTERVAL_MS = 50;
+
+/**
+ * Block without spinning. The write path is synchronous, so there is no event
+ * loop to yield to here.
+ *
+ * @param {number} ms
+ */
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
 export default class ConfigFileJsonRepository {
+  /**
+   * What this instance last observed on disk:
+   *
+   * - `undefined` - never looked, so nothing can be claimed about the file
+   * - `null`      - looked, and there was no file
+   * - `string`    - the exact bytes that were there
+   *
+   * "Never looked" and "looked and found nothing" have to stay distinct, or two
+   * nodes being set up concurrently would both write over each other believing
+   * they were creating the file.
+   *
+   * Concurrent writers are detected by comparing against this, so it must be
+   * refreshed on every successful write - the dashmate helper reads once at
+   * startup and then writes on every certificate renewal for the life of the
+   * process, and would otherwise conflict with its own previous write.
+   *
+   * One instance tracks one config file lifecycle: a second read() rebaselines
+   * it, so do not write a ConfigFile obtained from an earlier read afterwards.
+   *
+   * @type {string|null|undefined}
+   */
+  #baseline;
+
+  /**
+   * Distinguishes parked snapshots written by this process within the same
+   * millisecond.
+   *
+   * @type {number}
+   */
+  #rejectedCount = 0;
+
   /**
    * @param {migrateConfigFile} migrateConfigFile
    * @param {HomeDir} homeDir
@@ -17,6 +78,9 @@ export default class ConfigFileJsonRepository {
     this.migrateConfigFile = migrateConfigFile;
     this.ajv = new Ajv();
     this.configFilePath = homeDir.joinPath('config.json');
+    // Locking a sibling rather than the config file itself keeps first run
+    // working, where there is no config file to lock yet.
+    this.lockFilePath = homeDir.joinPath('config.json.lock');
   }
 
   /**
@@ -29,11 +93,18 @@ export default class ConfigFileJsonRepository {
   read(options = {}) {
     const { skipValidation = false } = options;
     if (!fs.existsSync(this.configFilePath)) {
+      // Record that the file was observed absent. The caller creates a default
+      // config file from here, and that write must still lose to another
+      // process that created one first.
+      this.#baseline = null;
+
       throw new ConfigFileNotFoundError(this.configFilePath);
     }
 
     const configFileJSON = fs.readFileSync(this.configFilePath, 'utf8');
 
+    this.#baseline = configFileJSON;
+
     let configFileData;
     try {
       configFileData = JSON.parse(configFileJSON);
@@ -87,14 +158,116 @@ export default class ConfigFileJsonRepository {
   /**
    * Save configs to file
    *
+   * Refuses to write when the file changed on disk since this instance read it,
+   * rather than reverting whatever the other process saved. The check and the
+   * replacement happen under a lock so two writers cannot both pass the check
+   * and then both write; the lock is held only for that, never for the duration
+   * of a command.
+   *
    * @param {ConfigFile} configFile
+   * @throws {ConfigFileConflictError} when another process wrote first
    * @returns {void}
    */
   write(configFile) {
-    const configFileJSON = JSON.stringify(configFile.toObject(), undefined, 2);
+    const configFileJSON = `${JSON.stringify(configFile.toObject(), undefined, 2)}\n`;
+
+    const release = this.#acquireLock();
+
+    try {
+      const currentJSON = fs.existsSync(this.configFilePath)
+        ? fs.readFileSync(this.configFilePath, 'utf8')
+        : null;
+
+      // Any observed change conflicts, including present-to-absent: recreating
+      // a config file somebody deliberately removed is the same lost update in
+      // the other direction.
+      if (this.#baseline !== undefined && currentJSON !== this.#baseline) {
+        throw this.#rejectStaleWrite(configFileJSON);
+      }
 
-    configFile.markAsSaved();
+      writeFileAtomic.sync(this.configFilePath, configFileJSON, 'utf8');
+
+      this.#baseline = configFileJSON;
+
+      // Only now is the state actually on disk. Clearing these before the write
+      // would leave the configs claiming to be saved after a failed one.
+      configFile.markAsSaved();
+      configFile.getAllConfigs().forEach((config) => config.markAsSaved());
+    } finally {
+      try {
+        release();
+      } catch {
+        // Releasing reports ERELEASED/ENOTACQUIRED when the lock was already
+        // gone. Nothing thrown from here may escape: it would replace the
+        // outcome the caller actually needs - including the conflict error
+        // naming where their configuration was parked - with a message about
+        // lock bookkeeping. A lock that cannot be released goes stale and is
+        // reclaimed by the next writer anyway.
+      }
+    }
+  }
+
+  /**
+   * Take the config file lock, waiting out a concurrent writer.
+   *
+   * proper-lockfile's sync API has no built-in retry, and failing on the first
+   * contended attempt would surface a spurious error for a lock that is only
+   * held for a rename.
+   *
+   * @returns {function} release
+   */
+  #acquireLock() {
+    const deadline = Date.now() + LOCK_ACQUIRE_TIMEOUT_MS;
+
+    for (;;) {
+      try {
+        return lockfile.lockSync(this.configFilePath, {
+          lockfilePath: this.lockFilePath,
+          // The config file legitimately does not exist on first run, and
+          // realpath resolution would fail on it.
+          realpath: false,
+          stale: LOCK_STALE_MS,
+          // The library's default handler rethrows, and it runs from a refresh
+          // timer rather than this call stack, so a lock compromised mid-write
+          // would take the whole process down. There is nothing useful to do
+          // about it here: the critical section lasts milliseconds, and the
+          // byte comparison against the baseline is what actually prevents a
+          // lost update - the lock only narrows the window it runs in.
+          onCompromised: () => {},
+        });
+      } catch (e) {
+        if (e.code !== 'ELOCKED' || Date.now() >= deadline) {
+          throw e;
+        }
+
+        sleepSync(LOCK_RETRY_INTERVAL_MS);
+      }
+    }
+  }
+
+  /**
+   * Park the state we refused to write, so material generated during the
+   * command is recoverable, and describe where it went.
+   *
+   * @param {string} configFileJSON
+   * @returns {ConfigFileConflictError}
+   */
+  #rejectStaleWrite(configFileJSON) {
+    // Colons are not legal in Windows filenames. The pid separates concurrent
+    // processes and the counter separates two conflicts from this one inside
+    // the same millisecond, so no parked state is ever overwritten by another.
+    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+
+    this.#rejectedCount += 1;
+
+    const rejectedPath = `${this.configFilePath}.rejected-${stamp}-${process.pid}-${this.#rejectedCount}`;
+
+    try {
+      writeFileAtomic.sync(rejectedPath, configFileJSON, { encoding: 'utf8', mode: 0o600 });
+    } catch (e) {
+      return new ConfigFileConflictError(this.configFilePath, null, e);
+    }
 
-    fs.writeFileSync(this.configFilePath, `${configFileJSON}\n`, 'utf8');
+    return new ConfigFileConflictError(this.configFilePath, rejectedPath);
   }
 }
diff --git a/packages/dashmate/src/config/errors/ConfigFileConflictError.js b/packages/dashmate/src/config/errors/ConfigFileConflictError.js
new file mode 100644
index 00000000000..3b3c58ceae3
--- /dev/null
+++ b/packages/dashmate/src/config/errors/ConfigFileConflictError.js
@@ -0,0 +1,49 @@
+import AbstractError from '../../errors/AbstractError.js';
+
+/**
+ * Raised when the config file changed on disk after this process loaded it.
+ *
+ * Writing would silently revert whatever the other process saved, so the write
+ * is refused. The in-memory state is parked next to the config file first, so
+ * material generated during the command - operator keys, a spork key, a miner
+ * address - is never lost with the refused write.
+ */
+export default class ConfigFileConflictError extends AbstractError {
+  /**
+   * @param {string} configFilePath
+   * @param {string|null} rejectedSnapshotPath - null when parking it also failed
+   * @param {Error} [snapshotError] - why parking failed, when it did
+   */
+  constructor(configFilePath, rejectedSnapshotPath, snapshotError = undefined) {
+    const recovery = rejectedSnapshotPath === null
+      ? `The changes from this command could NOT be saved either: ${snapshotError?.message}. They are lost.`
+      : `The changes from this command were saved to '${rejectedSnapshotPath}' so you can reconcile them.`;
+
+    super(`'${configFilePath}' was modified by another process after this command loaded it.`
+      + ` Refusing to overwrite it. ${recovery}`);
+
+    this.configFilePath = configFilePath;
+    this.rejectedSnapshotPath = rejectedSnapshotPath;
+    this.snapshotError = snapshotError;
+
+    // Stable identifier for callers that need to branch on this without
+    // depending on the class identity across module instances.
+    this.code = 'DASHMATE_CONFIG_FILE_CONFLICT';
+  }
+
+  /**
+   * @returns {string}
+   */
+  getConfigFilePath() {
+    return this.configFilePath;
+  }
+
+  /**
+   * Path the refused state was parked at, or null if that failed too.
+   *
+   * @returns {string|null}
+   */
+  getRejectedSnapshotPath() {
+    return this.rejectedSnapshotPath;
+  }
+}
diff --git a/packages/dashmate/src/oclif/command/BaseCommand.js b/packages/dashmate/src/oclif/command/BaseCommand.js
index 3fa7d2c0313..2390d75d696 100644
--- a/packages/dashmate/src/oclif/command/BaseCommand.js
+++ b/packages/dashmate/src/oclif/command/BaseCommand.js
@@ -111,6 +111,11 @@ export default class BaseCommand extends Command {
         const configFile = this.container.resolve('configFile');
 
         if (configFile.isChanged()) {
+          // Captured before the write, which clears these flags once the new
+          // state is on disk.
+          const changedConfigs = configFile.getAllConfigs()
+            .filter((config) => config.isChanged());
+
           configFileRepository.write(configFile);
 
           /**
@@ -118,9 +123,11 @@ export default class BaseCommand extends Command {
            */
           const writeConfigTemplates = this.container.resolve('writeConfigTemplates');
 
-          configFile.getAllConfigs()
-            .filter((config) => config.isChanged())
-            .forEach(writeConfigTemplates);
+          // Re-rendering only what changed is safe because upgrading Dashmate
+          // stamps the new version into the config file even when no migration
+          // applies, which marks every config changed - so a release that edits
+          // a template still reaches every node on its next command.
+          changedConfigs.forEach(writeConfigTemplates);
         }
       }
 
diff --git a/packages/dashmate/src/templates/writeConfigTemplatesFactory.js b/packages/dashmate/src/templates/writeConfigTemplatesFactory.js
index 1684e61f2fb..c1b33df6cce 100644
--- a/packages/dashmate/src/templates/writeConfigTemplatesFactory.js
+++ b/packages/dashmate/src/templates/writeConfigTemplatesFactory.js
@@ -9,8 +9,6 @@ export default function writeConfigTemplatesFactory(renderServiceTemplates, writ
   function writeConfigTemplates(config) {
     const serviceConfigs = renderServiceTemplates(config);
     writeServiceConfigs(config.getName(), serviceConfigs);
-
-    config.markAsSaved();
   }
 
   return writeConfigTemplates;
diff --git a/packages/dashmate/test/unit/config/Config.spec.js b/packages/dashmate/test/unit/config/Config.spec.js
index b5d652dd678..13705cf2286 100644
--- a/packages/dashmate/test/unit/config/Config.spec.js
+++ b/packages/dashmate/test/unit/config/Config.spec.js
@@ -13,6 +13,43 @@ describe('Config', () => {
     });
   });
 
+  describe('change tracking', () => {
+    let storedOptions;
+
+    beforeEach(() => {
+      storedOptions = getBaseConfigFactory(HomeDir.createTemp())().getStoredOptions();
+    });
+
+    // Loading a config off disk is not an edit to it. When hydration marks a
+    // config dirty, every command - including pure readers like `config get` -
+    // persists the whole config file on exit, and a slow reader can write its
+    // stale snapshot over a concurrent `config set`.
+    it('should not consider a freshly hydrated config changed', () => {
+      const config = new Config('testnet', storedOptions);
+
+      expect(config.isChanged()).to.be.false();
+    });
+
+    it('should consider a config changed after set()', () => {
+      const config = new Config('testnet', storedOptions);
+
+      config.set('description', 'changed');
+
+      expect(config.isChanged()).to.be.true();
+    });
+
+    // setOptions() is a genuine mutation when called on an existing config
+    // (resetNodeTaskFactory restores defaults through it), so only the
+    // constructor's initial hydration is exempt.
+    it('should consider a config changed after setOptions() post-construction', () => {
+      const config = new Config('testnet', storedOptions);
+
+      config.setOptions(storedOptions);
+
+      expect(config.isChanged()).to.be.true();
+    });
+  });
+
   describe('.isSchemaPathAllowed', () => {
     // The bug that triggered this method: `dashmate config set
     // platform.drive.abci.docker.build.buildArgs.SDK_TEST_DATA true`
diff --git a/packages/dashmate/test/unit/config/configFile/ConfigFileJsonRepository.spec.js b/packages/dashmate/test/unit/config/configFile/ConfigFileJsonRepository.spec.js
new file mode 100644
index 00000000000..34266c672db
--- /dev/null
+++ b/packages/dashmate/test/unit/config/configFile/ConfigFileJsonRepository.spec.js
@@ -0,0 +1,353 @@
+import fs from 'fs';
+import { spawn } from 'child_process';
+import { expect } from 'chai';
+import HomeDir from '../../../../src/config/HomeDir.js';
+import getBaseConfigFactory from '../../../../configs/defaults/getBaseConfigFactory.js';
+import ConfigFile from '../../../../src/config/configFile/ConfigFile.js';
+import ConfigFileJsonRepository from '../../../../src/config/configFile/ConfigFileJsonRepository.js';
+
+const CURRENT_FORMAT_VERSION = '4.1.0';
+
+describe('ConfigFileJsonRepository', () => {
+  let homeDir;
+  let configFilePath;
+  let identityMigration;
+  // Tracked so a failed assertion cannot leave a spawned lock holder behind
+  // still owning the lock directory after the test that created it is gone.
+  let lockHolder;
+
+  /**
+   * Seed a valid config file on disk, the way a configured node would have one.
+   *
+   * @return {string} the JSON written
+   */
+  function seedConfigFile() {
+    const baseConfig = getBaseConfigFactory(homeDir)();
+
+    const configFile = new ConfigFile(
+      [baseConfig],
+      CURRENT_FORMAT_VERSION,
+      'abcdef12',
+      'base',
+      null,
+    );
+
+    const json = `${JSON.stringify(configFile.toObject(), undefined, 2)}\n`;
+
+    fs.writeFileSync(configFilePath, json, 'utf8');
+
+    return json;
+  }
+
+  beforeEach(() => {
+    homeDir = HomeDir.createTemp();
+    configFilePath = homeDir.joinPath('config.json');
+    identityMigration = (data) => data;
+  });
+
+  afterEach(() => {
+    if (lockHolder && lockHolder.exitCode === null && lockHolder.signalCode === null) {
+      lockHolder.kill();
+    }
+
+    lockHolder = undefined;
+
+    homeDir.remove();
+  });
+
+  describe('#read', () => {
+    // A load is not an edit. If hydration leaves the file dirty, BaseCommand
+    // persists it on exit even for `config get`, which is what lets a slow
+    // reader overwrite a concurrent `config set`.
+    it('should return a clean config file when nothing was migrated', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir);
+
+      const configFile = repository.read();
+
+      expect(configFile.isChanged()).to.be.false();
+      expect(configFile.getAllConfigs().filter((config) => config.isChanged())).to.be.empty();
+    });
+
+    it('should return a changed config file when it was migrated', () => {
+      seedConfigFile();
+
+      const migration = (data) => ({ ...data, configFormatVersion: '9.9.9' });
+
+      const repository = new ConfigFileJsonRepository(migration, homeDir);
+
+      const configFile = repository.read();
+
+      expect(configFile.isChanged()).to.be.true();
+      expect(configFile.getAllConfigs().every((config) => config.isChanged())).to.be.true();
+    });
+
+    // The symptom operators reported. Asserting on file CONTENT would pass
+    // against the buggy code, because re-serializing an unchanged config is
+    // byte-identical - the defect is that the write happens at all, carrying a
+    // stale snapshot.
+    it('should leave the file untouched when a read-only command exits', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir);
+      const { mtimeMs, ino } = fs.statSync(configFilePath);
+
+      const configFile = repository.read();
+
+      // What BaseCommand.finally() does
+      if (configFile.isChanged()) {
+        repository.write(configFile);
+      }
+
+      const after = fs.statSync(configFilePath);
+
+      expect(after.mtimeMs).to.equal(mtimeMs);
+      expect(after.ino).to.equal(ino);
+    });
+  });
+
+  describe('#write', () => {
+    it('should persist changes and mark the config file and its configs saved', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir);
+      const configFile = repository.read();
+
+      configFile.getConfig('base').set('description', 'changed');
+
+      repository.write(configFile);
+
+      expect(configFile.isChanged()).to.be.false();
+      expect(configFile.getAllConfigs().filter((config) => config.isChanged())).to.be.empty();
+
+      const reread = new ConfigFileJsonRepository(identityMigration, homeDir).read();
+
+      expect(reread.getConfig('base').get('description')).to.equal('changed');
+    });
+
+    it('should preserve the file mode, valid JSON and trailing newline, and leave no temp files', () => {
+      seedConfigFile();
+      fs.chmodSync(configFilePath, 0o600);
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir);
+      const configFile = repository.read();
+
+      configFile.getConfig('base').set('description', 'changed');
+
+      repository.write(configFile);
+
+      const raw = fs.readFileSync(configFilePath, 'utf8');
+
+      // eslint-disable-next-line no-bitwise
+      expect(fs.statSync(configFilePath).mode & 0o777).to.equal(0o600);
+      expect(raw.endsWith('}\n')).to.be.true();
+      expect(() => JSON.parse(raw)).to.not.throw();
+      expect(fs.readdirSync(homeDir.getPath()).filter((n) => n !== 'config.json')).to.be.empty();
+    });
+
+    // The helper daemon reads once at startup and writes on every certificate
+    // renewal for the life of the process. If the staleness baseline is not
+    // refreshed after each write, its second write conflicts with its own first.
+    it('should allow repeated writes from one long-lived instance', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir);
+      const configFile = repository.read();
+
+      configFile.getConfig('base').set('description', 'first');
+      repository.write(configFile);
+
+      configFile.getConfig('base').set('description', 'second');
+
+      expect(() => repository.write(configFile)).to.not.throw();
+
+      const reread = new ConfigFileJsonRepository(identityMigration, homeDir).read();
+
+      expect(reread.getConfig('base').get('description')).to.equal('second');
+    });
+  });
+
+  describe('#write concurrency', () => {
+    // The reported lost update: a process loads the config, another process
+    // changes and saves it, and the first process writes its stale snapshot
+    // last. Asserting only "the second value survived" would also pass if the
+    // stale write silently did nothing, so the contract itself is pinned:
+    // it refuses loudly, leaves the file alone, and keeps the rejected state.
+    it('should refuse a stale write instead of clobbering a concurrent update', () => {
+      seedConfigFile();
+
+      const slowReader = new ConfigFileJsonRepository(identityMigration, homeDir);
+      const staleConfigFile = slowReader.read();
+
+      // A concurrent `dashmate config set` lands and exits successfully
+      const writer = new ConfigFileJsonRepository(identityMigration, homeDir);
+      const freshConfigFile = writer.read();
+      freshConfigFile.getConfig('base').set('description', 'set-by-concurrent-writer');
+      writer.write(freshConfigFile);
+
+      const onDisk = fs.readFileSync(configFilePath, 'utf8');
+
+      staleConfigFile.getConfig('base').set('description', 'stale-snapshot');
+
+      let thrown;
+      try {
+        slowReader.write(staleConfigFile);
+      } catch (e) {
+        thrown = e;
+      }
+
+      expect(thrown, 'stale write must not succeed').to.exist();
+      expect(thrown.code).to.equal('DASHMATE_CONFIG_FILE_CONFLICT');
+
+      // the concurrent writer's value survives, byte for byte
+      expect(fs.readFileSync(configFilePath, 'utf8')).to.equal(onDisk);
+
+      // nothing generated in memory is lost - it is parked for the operator
+      const rejected = fs.readdirSync(homeDir.getPath())
+        .filter((name) => name.startsWith('config.json.rejected-'));
+
+      expect(rejected).to.have.lengthOf(1);
+      expect(thrown.message).to.contain(rejected[0]);
+
+      const parked = JSON.parse(fs.readFileSync(homeDir.joinPath(rejected[0]), 'utf8'));
+
+      expect(parked.configs.base.description).to.equal('stale-snapshot');
+    });
+
+    // Two nodes being set up at once both find no config file. "I have never
+    // looked" and "I looked and there was nothing there" are different claims,
+    // and only the second can detect that someone else created the file first.
+    it('should refuse a first-run write when another process created the file first', () => {
+      const first = new ConfigFileJsonRepository(identityMigration, homeDir);
+      const second = new ConfigFileJsonRepository(identityMigration, homeDir);
+
+      // both observe an absent config file
+      expect(() => first.read()).to.throw();
+      expect(() => second.read()).to.throw();
+
+      const configFile = new ConfigFile(
+        [getBaseConfigFactory(homeDir)()],
+        CURRENT_FORMAT_VERSION,
+        'abcdef12',
+        'base',
+        null,
+      );
+
+      first.write(configFile);
+
+      const onDisk = fs.readFileSync(configFilePath, 'utf8');
+
+      let thrown;
+      try {
+        second.write(configFile);
+      } catch (e) {
+        thrown = e;
+      }
+
+      expect(thrown, 'second first-run write must not clobber the first').to.exist();
+      expect(thrown.code).to.equal('DASHMATE_CONFIG_FILE_CONFLICT');
+      expect(fs.readFileSync(configFilePath, 'utf8')).to.equal(onDisk);
+    });
+
+    // Present-to-absent is a change like any other. Recreating our old snapshot
+    // over a deliberate removal is the same lost update in the other direction.
+    it('should refuse to recreate a config file that was deleted after it was read', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir);
+      const configFile = repository.read();
+
+      fs.unlinkSync(configFilePath);
+
+      configFile.getConfig('base').set('description', 'stale-snapshot');
+
+      let thrown;
+      try {
+        repository.write(configFile);
+      } catch (e) {
+        thrown = e;
+      }
+
+      expect(thrown, 'must not resurrect a deleted config file').to.exist();
+      expect(thrown.code).to.equal('DASHMATE_CONFIG_FILE_CONFLICT');
+      expect(fs.existsSync(configFilePath)).to.be.false();
+    });
+
+    // Comparing against the baseline is not enough on its own: two writers can
+    // both read the same bytes, both decide they are current, and both replace
+    // the file. Only a lock closes that window, and only a genuinely separate
+    // process can prove the lock is honoured. proper-lockfile represents a held
+    // lock as a directory, so the other process needs nothing but `fs`.
+    it('should wait for a lock held by another process before writing', function it0(done) {
+      this.timeout(20000);
+
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir);
+      const configFile = repository.read();
+
+      configFile.getConfig('base').set('description', 'written-after-waiting');
+
+      const lockPath = homeDir.joinPath('config.json.lock');
+      const holdMs = 700;
+
+      lockHolder = spawn(
+        process.execPath,
+        ['-e', `require('fs').mkdirSync(${JSON.stringify(lockPath)});`
+          + `setTimeout(() => require('fs').rmdirSync(${JSON.stringify(lockPath)}), ${holdMs});`],
+        { stdio: 'ignore' },
+      );
+
+      lockHolder.on('error', done);
+
+      // Wait for the other process to actually take the lock. Synchronous on
+      // purpose - the write we are about to make is synchronous too.
+      // Polled with a real sleep rather than a tight loop - spinning here would
+      // peg a CI core for the whole timeout whenever the child fails to start.
+      const deadline = Date.now() + 10000;
+      while (!fs.existsSync(lockPath) && Date.now() < deadline) {
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+      }
+
+      expect(fs.existsSync(lockPath), 'other process should hold the lock').to.be.true();
+
+      const startedAt = Date.now();
+
+      repository.write(configFile);
+
+      const waitedMs = Date.now() - startedAt;
+
+      // It blocked rather than writing straight through the other holder.
+      expect(waitedMs).to.be.at.least(holdMs / 2);
+      expect(fs.existsSync(lockPath), 'lock should be released again').to.be.false();
+
+      const reread = new ConfigFileJsonRepository(identityMigration, homeDir).read();
+
+      expect(reread.getConfig('base').get('description')).to.equal('written-after-waiting');
+
+      lockHolder.on('exit', () => done());
+    });
+
+    it('should succeed after reloading following a conflict', () => {
+      seedConfigFile();
+
+      const slowReader = new ConfigFileJsonRepository(identityMigration, homeDir);
+      slowReader.read();
+
+      const writer = new ConfigFileJsonRepository(identityMigration, homeDir);
+      const freshConfigFile = writer.read();
+      freshConfigFile.getConfig('base').set('description', 'concurrent');
+      writer.write(freshConfigFile);
+
+      const reloaded = slowReader.read();
+      reloaded.getConfig('base').set('description', 'after-reload');
+
+      expect(() => slowReader.write(reloaded)).to.not.throw();
+
+      const reread = new ConfigFileJsonRepository(identityMigration, homeDir).read();
+
+      expect(reread.getConfig('base').get('description')).to.equal('after-reload');
+    });
+  });
+});
diff --git a/packages/dashmate/test/unit/config/configFile/migrateConfigFileFactory.spec.js b/packages/dashmate/test/unit/config/configFile/migrateConfigFileFactory.spec.js
index a1065b8b10e..1d849f314d0 100644
--- a/packages/dashmate/test/unit/config/configFile/migrateConfigFileFactory.spec.js
+++ b/packages/dashmate/test/unit/config/configFile/migrateConfigFileFactory.spec.js
@@ -260,4 +260,39 @@ describe('migrateConfigFileFactory', () => {
       );
     }
   });
+
+  // Upgrading Dashmate has to leave a mark on the config file even when nothing
+  // needed migrating, because that recorded version is the only thing that tells
+  // the next command every config is stale. `ConfigFileJsonRepository.read()`
+  // marks all configs changed when the version moved, and that is what re-renders
+  // service templates after an upgrade. Stamping the version only when a
+  // migration happened to apply would leave nodes running templates rendered by
+  // an older Dashmate, with nothing to signal it.
+  it('should record the new version after an upgrade even when no migration applies', () => {
+    const configFileData = getConfigFileDataV0250();
+
+    // Both versions sit above every migration key, so nothing can match and the
+    // recorded version is the only thing the upgrade can change.
+    const installedVersion = '98.0.0';
+    const upgradedVersion = '99.0.0';
+
+    configFileData.configFormatVersion = installedVersion;
+
+    const migrated = migrateConfigFile(
+      configFileData,
+      configFileData.configFormatVersion,
+      upgradedVersion,
+    );
+
+    expect(migrated.configFormatVersion).to.equal(upgradedVersion);
+
+    // And migrating again from there is a no-op, so the mark does not repeat.
+    const again = migrateConfigFile(
+      migrated,
+      migrated.configFormatVersion,
+      upgradedVersion,
+    );
+
+    expect(again.configFormatVersion).to.equal(upgradedVersion);
+  });
 });
diff --git a/yarn.lock b/yarn.lock
index c21621aecb0..659b772ef72 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -7351,6 +7351,7 @@ __metadata:
     oclif: "npm:^4.0.3"
     pretty-bytes: "npm:^5.3.0"
     pretty-ms: "npm:^7.0.0"
+    proper-lockfile: "npm:^4.1.2"
     public-ip: "npm:^6.0.1"
     qs: "npm:^6.14.2"
     rxjs: "npm:^6.6.7"
@@ -7361,6 +7362,7 @@ __metadata:
     table: "npm:^6.8.1"
     tar: "npm:7.5.10"
     wrap-ansi: "npm:^7.0.0"
+    write-file-atomic: "npm:^5.0.1"
   bin:
     dashmate: ./bin/run.js
   languageName: unknown
@@ -14769,6 +14771,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"proper-lockfile@npm:^4.1.2":
+  version: 4.1.2
+  resolution: "proper-lockfile@npm:4.1.2"
+  dependencies:
+    graceful-fs: "npm:^4.2.4"
+    retry: "npm:^0.12.0"
+    signal-exit: "npm:^3.0.2"
+  checksum: 10/000a4875f543f591872b36ca94531af8a6463ddb0174f41c0b004d19e231d7445268b422ff1ea595e43d238655c702250cd3d27f408e7b9d97b56f1533ba26bf
+  languageName: node
+  linkType: hard
+
 "protobufjs@npm:^6.11.4":
   version: 6.11.4
   resolution: "protobufjs@npm:6.11.4"
@@ -18741,6 +18754,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"write-file-atomic@npm:^5.0.1":
+  version: 5.0.1
+  resolution: "write-file-atomic@npm:5.0.1"
+  dependencies:
+    imurmurhash: "npm:^0.1.4"
+    signal-exit: "npm:^4.0.1"
+  checksum: 10/648efddba54d478d0e4330ab6f239976df3b9752b123db5dc9405d9b5af768fa9d70ce60c52fdbe61d1200d24350bc4fbcbaf09288496c2be050de126bd95b7e
+  languageName: node
+  linkType: hard
+
 "ws@npm:^8.17.1":
   version: 8.17.1
   resolution: "ws@npm:8.17.1"