diff --git a/changelog.md b/changelog.md
index 22a448d..a1abfef 100644
--- a/changelog.md
+++ b/changelog.md
@@ -9,6 +9,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Marked `CBCsrf` as `threadSafe` so WireBox publishes the singleton only after
+  autowiring it. Concurrent requests hitting a cold singleton cache (right after a
+  framework reinit, for instance) could otherwise get a half-wired instance and fail
+  with `variable [CACHESTORAGE] doesn't exist`.
+
 ## [3.2.0] - 2025-02-19
 
 ### Added
diff --git a/models/cbcsrf.cfc b/models/cbcsrf.cfc
index 2d6e4e3..1f7e35f 100644
--- a/models/cbcsrf.cfc
+++ b/models/cbcsrf.cfc
@@ -4,7 +4,7 @@
  * ---
  * Service that encapsulates token security against cross site request forgery (csrf)
  */
-component accessors="true" singleton {
+component accessors="true" singleton threadSafe {
 
 	/* *********************************************************************
 	 **						DI