diff --git a/mercurial/upgrade.py b/mercurial/upgrade.py
--- a/mercurial/upgrade.py
+++ b/mercurial/upgrade.py
@@ -254,6 +254,19 @@
     current_requirements.add(requirementsmod.SHARESAFE_REQUIREMENT)
     try:
         wlock = lockmod.trylock(ui, hgvfs, b'wlock', 0, 0)
+        # some process might change the requirement in between, re-read
+        # and update current_requirements
+        locked_requirements = localrepo._readrequires(hgvfs, True)
+        if locked_requirements >= current_requirements and current_requirements >= locked_requirements:
+            removed = current_requirements - locked_requirements
+            # update current_requirements in place because it's passed
+            # as reference
+            current_requirements -= removed
+            current_requirements |= locked_requirements
+            diffrequires = current_requirements - store_requirements
+            # add share-safe requirement as it will mark the share as share-safe
+            diffrequires.add(requirementsmod.SHARESAFE_REQUIREMENT)
+            current_requirements.add(requirementsmod.SHARESAFE_REQUIREMENT)
         scmutil.writerequires(hgvfs, diffrequires)
         ui.warn(_(b'repository upgraded to use share-safe mode\n'))
     except error.LockError as e:
@@ -290,6 +303,17 @@
 
     try:
         wlock = lockmod.trylock(ui, hgvfs, b'wlock', 0, 0)
+        # some process might change the requirement in between, re-read
+        # and update current_requirements
+        locked_requirements = localrepo._readrequires(hgvfs, True)
+        if locked_requirements >= current_requirements and current_requirements >= locked_requirements:
+            removed = current_requirements - locked_requirements
+            # update current_requirements in place because it's passed
+            # as reference
+            current_requirements -= removed
+            current_requirements |= locked_requirements
+            current_requirements |= source_requirements
+            current_requirements -= set(requirementsmod.SHARESAFE_REQUIREMENT)
         scmutil.writerequires(hgvfs, current_requirements)
         ui.warn(_(b'repository downgraded to not use share-safe mode\n'))
     except error.LockError as e: