diff --git a/cmd/dashboard/controller/member_api.go b/cmd/dashboard/controller/member_api.go
index 9cc2667..93f8bac 100644
--- a/cmd/dashboard/controller/member_api.go
+++ b/cmd/dashboard/controller/member_api.go
@@ -40,6 +40,8 @@ func (ma *memberAPI) addServer(c *gin.Context) {
 	var s model.Server
 	err := c.ShouldBindJSON(&sf)
 	if err == nil {
+		dao.ServerLock.Lock()
+		defer dao.ServerLock.Unlock()
 		s.Name = sf.Name
 		s.Secret = com.MD5(fmt.Sprintf("%s%s%d", time.Now(), sf.Name, dao.Admin.ID))
 		s.Secret = s.Secret[:10]
@@ -52,8 +54,6 @@ func (ma *memberAPI) addServer(c *gin.Context) {
 		})
 		return
 	}
-	dao.ServerLock.Lock()
-	defer dao.ServerLock.Unlock()
 	dao.ServerList[fmt.Sprintf("%d", s.ID)] = &s
 	c.JSON(http.StatusOK, model.Response{
 		Code: http.StatusOK,
diff --git a/service/rpc/nezha.go b/service/rpc/nezha.go
index a8eca69..dcc118c 100644
--- a/service/rpc/nezha.go
+++ b/service/rpc/nezha.go
@@ -36,10 +36,10 @@ func (s *NezhaHandler) Heartbeat(r *pb.Beat, stream pb.NezhaService_HeartbeatSer
 		return err
 	}
 	dao.ServerLock.RLock()
-	defer dao.ServerLock.RUnlock()
 	closeCh := make(chan error)
 	dao.ServerList[clientID].StreamClose = closeCh
 	dao.ServerList[clientID].Stream = stream
+	dao.ServerLock.RUnlock()
 	select {
 	case err = <-closeCh:
 		return err