diff --git a/docker/README.md b/docker/README.md
index f1a1b7d0..ec4e9d24 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -1,7 +1,8 @@
 # Wolfskin TV container builds
 
 Run from a full Git checkout with the upstream `v*` and `p*` tags available. The
-host needs Docker, GNU Make, Bash, and Git, not Java or the Android SDK.
+host needs Docker, GNU Make, Bash, Git, and `flock` (util-linux), not Java or the
+Android SDK.
 
 ```sh
 git fetch origin --tags
@@ -46,6 +47,15 @@ Override `WOLFSKIN_BUILD_IMAGE` to change the locally built image tag and
 `WOLFSKIN_GRADLE_VOLUME` to isolate a cache. `make build-image` builds only the
 image. Do not delete shared caches during another build.
 
+Every Gradle container holds a host-side exclusive lock for its entire run.
+Concurrent targets sharing a cache queue rather than timing out on Gradle's
+cross-container cache journal lock; a waiting invocation prints one line.
+The default lock is `/var/tmp/${WOLFSKIN_GRADLE_VOLUME}.gradle.lock` (using
+`wolfskin-gradle` when unset). Override `WOLFSKIN_GRADLE_LOCK_FILE` with a path
+whose parent directory already exists. All callers sharing a volume must use
+the same lock path on the Docker host. Do not delete the file while builds are
+running or waiting. The lock releases automatically when the invocation exits.
+
 ## Release credentials
 
 The default escrow is
diff --git a/docker/gradle.sh b/docker/gradle.sh
index 76950dc6..b5624cbf 100755
--- a/docker/gradle.sh
+++ b/docker/gradle.sh
@@ -8,6 +8,12 @@ git_common=$(git rev-parse --path-format=absolute --git-common-dir)
 image=${WOLFSKIN_BUILD_IMAGE:-wolfskin-build:sdk37-jdk21}
 cache=${WOLFSKIN_GRADLE_VOLUME:-wolfskin-gradle}
 secrets=${WOLFSKIN_SECRETS_DIR:-/opt/stacks/ventoy/machine-parity/manifest-tank/secrets/wolfskin}
+lock=${WOLFSKIN_GRADLE_LOCK_FILE:-/var/tmp/${cache}.gradle.lock}
+exec {lock_fd}>"$lock"
+if ! flock --exclusive --nonblock "$lock_fd"; then
+    printf 'Waiting for Gradle cache lock: %s\n' "$lock" >&2
+    flock --exclusive "$lock_fd"
+fi
 arguments=(--rm --platform linux/amd64 --user "$(id -u):$(id -g)"
     --mount "type=bind,src=$root,dst=$root" --workdir "$root"
     --mount "type=volume,src=$cache,dst=/gradle"