diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0e01f43c0..02cc15212 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ nav_order: 1
 
 ## [X.Y.Z] - YYYY-MM-DD
 
+## [4.9.4] - 2023-12-13
+
+- Fix race issues with `aiven_mirrormaker_replication_flow` on create/update/delete operations   
+
 ## [4.9.3] - 2023-10-27
 
 - Deprecating `project_user`, `account_team` and `account_team_member` resources
diff --git a/internal/sdkprovider/service/kafka/mirrormaker_replication_flow.go b/internal/sdkprovider/service/kafka/mirrormaker_replication_flow.go
index f3a565d29..9f29fe2c5 100644
--- a/internal/sdkprovider/service/kafka/mirrormaker_replication_flow.go
+++ b/internal/sdkprovider/service/kafka/mirrormaker_replication_flow.go
@@ -2,6 +2,7 @@ package kafka
 
 import (
 	"context"
+	"sync"
 
 	"github.com/aiven/aiven-go-client/v2"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -13,6 +14,9 @@ import (
 )
 
 var (
+	// lockReplicationFlow a lock for any "write" operations.
+	// todo: remove the lock when API race is fixed
+	lockReplicationFlow      = sync.Mutex{}
 	defaultReplicationPolicy = "org.apache.kafka.connect.mirror.DefaultReplicationPolicy"
 
 	replicationPolicies = []string{
@@ -111,6 +115,9 @@ func ResourceMirrorMakerReplicationFlow() *schema.Resource {
 }
 
 func resourceMirrorMakerReplicationFlowCreate(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
+	lockReplicationFlow.Lock()
+	defer lockReplicationFlow.Unlock()
+
 	client := m.(*aiven.Client)
 
 	project := d.Get("project").(string)
@@ -193,6 +200,9 @@ func resourceMirrorMakerReplicationFlowRead(ctx context.Context, d *schema.Resou
 }
 
 func resourceMirrorMakerReplicationFlowUpdate(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
+	lockReplicationFlow.Lock()
+	defer lockReplicationFlow.Unlock()
+
 	client := m.(*aiven.Client)
 
 	project, serviceName, sourceCluster, targetCluster, err := schemautil.SplitResourceID4(d.Id())
@@ -227,6 +237,9 @@ func resourceMirrorMakerReplicationFlowUpdate(ctx context.Context, d *schema.Res
 }
 
 func resourceMirrorMakerReplicationFlowDelete(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
+	lockReplicationFlow.Lock()
+	defer lockReplicationFlow.Unlock()
+
 	client := m.(*aiven.Client)
 
 	project, serviceName, sourceCluster, targetCluster, err := schemautil.SplitResourceID4(d.Id())