diff --git a/cmd/syncthing/main.go b/cmd/syncthing/main.go
index 172ca9cbe..d666377c5 100644
--- a/cmd/syncthing/main.go
+++ b/cmd/syncthing/main.go
@@ -22,7 +22,6 @@ import (
 	"path"
 	"path/filepath"
 	"regexp"
-	"runtime"
 	"runtime/pprof"
 	"sort"
 	"strconv"
@@ -442,7 +441,7 @@ func (c *serveCmd) syncthingMain() {
 	}
 
 	// Ensure we are the only running instance
-	lf := flock.New(locations.Get(locations.CertFile))
+	lf := flock.New(locations.Get(locations.LockFile))
 	locked, err := lf.TryLock()
 	if err != nil {
 		l.Warnln("Failed to acquire lock:", err)
@@ -585,7 +584,10 @@ func (c *serveCmd) syncthingMain() {
 		pprof.StopCPUProfile()
 	}
 
-	runtime.KeepAlive(lf) // ensure lock is still held to this point
+	// Best effort remove lockfile, doesn't matter if it succeeds
+	_ = lf.Unlock()
+	_ = os.Remove(locations.Get(locations.LockFile))
+
 	os.Exit(int(status))
 }
 
@@ -887,7 +889,7 @@ func (u upgradeCmd) Run() error {
 
 	release, err := checkUpgrade()
 	if err == nil {
-		lf := flock.New(locations.Get(locations.CertFile))
+		lf := flock.New(locations.Get(locations.LockFile))
 		locked, err := lf.TryLock()
 		if err != nil {
 			l.Warnln("Upgrade:", err)
diff --git a/lib/locations/locations.go b/lib/locations/locations.go
index 153b89d1d..531be714e 100644
--- a/lib/locations/locations.go
+++ b/lib/locations/locations.go
@@ -34,6 +34,7 @@ const (
 	AuditLog       LocationEnum = "auditLog"
 	GUIAssets      LocationEnum = "guiAssets"
 	DefFolder      LocationEnum = "defFolder"
+	LockFile       LocationEnum = "lockFile"
 )
 
 type BaseDirEnum string
@@ -127,6 +128,7 @@ var locationTemplates = map[LocationEnum]string{
 	AuditLog:       "${data}/audit-%{timestamp}.log",
 	GUIAssets:      "${config}/gui",
 	DefFolder:      "${userHome}/Sync",
+	LockFile:       "${data}/syncthing.lock",
 }
 
 var locations = make(map[LocationEnum]string)