diff --git a/third_party/silentdragonxlite/silentdragonxlite-cli/lib/src/lightwallet.rs b/third_party/silentdragonxlite/silentdragonxlite-cli/lib/src/lightwallet.rs
index e2a3585..398066b 100644
--- a/third_party/silentdragonxlite/silentdragonxlite-cli/lib/src/lightwallet.rs
+++ b/third_party/silentdragonxlite/silentdragonxlite-cli/lib/src/lightwallet.rs
@@ -659,15 +659,17 @@ impl LightWallet {
             return "Error: Can't add key while wallet is encrypted".to_string();
         }
 
-        let pos = self.tkeys.read().unwrap().len() as u32;
+        // PBKDF2 (the slow part) outside the lock; hold ONE write guard across read-modify-write.
         let bip39_seed = bip39::Seed::new(&Mnemonic::from_entropy(&self.seed, Language::English).unwrap(), "");
-        
-        let sk = LightWallet::get_taddr_from_bip39seed(&self.config, &bip39_seed.as_bytes(), pos);
-        let address = self.address_from_sk(&sk);
-
-        self.tkeys.write().unwrap().push(WalletTKey::new_hdkey(sk, address.clone()));
-
-        address
+        let mut tkeys = self.tkeys.write().unwrap();
+        let mut pos = tkeys.len() as u32; // same start index as today (counts imported keys too - unchanged)
+        loop {
+            let sk = LightWallet::get_taddr_from_bip39seed(&self.config, &bip39_seed.as_bytes(), pos);
+            let address = self.address_from_sk(&sk);
+            if tkeys.iter().any(|t| t.address == address) { pos += 1; continue; }
+            tkeys.push(WalletTKey::new_hdkey(sk, address.clone()));
+            return address;
+        }
     }
 
     pub fn import_taddr(&mut self, sk: String,  birthday: u64) -> String {