diff --git a/src/wallet/asyncrpcoperation_autoshieldcoinbase.cpp b/src/wallet/asyncrpcoperation_autoshieldcoinbase.cpp
index aa79af438..74af78a9b 100644
--- a/src/wallet/asyncrpcoperation_autoshieldcoinbase.cpp
+++ b/src/wallet/asyncrpcoperation_autoshieldcoinbase.cpp
@@ -22,6 +22,18 @@ extern std::string randomSietchZaddr();
 
 // Serialized-size estimates for one spent input (kept in sync with rpcwallet.cpp)
 static const size_t AUTOSHIELD_CTXIN_DUST_SIZE = 148;
+// Every autoshield tx carries THREE Sapling OutputDescriptions -- the change
+// note to destZaddr plus the two Sietch dummies -- at ~948 bytes each. Reserving
+// 2000 for "header + sietch outputs" was ~900 bytes short before a single input
+// was counted, so a large enough round could build a tx over MAX_TX_SIZE.
+static const size_t AUTOSHIELD_SAPLING_OUTPUT_SIZE = 948;
+static const size_t AUTOSHIELD_TX_OVERHEAD = (3 * AUTOSHIELD_SAPLING_OUTPUT_SIZE) + 256;
+// Hard cap on inputs per round, mirroring z_shieldcoinbase's
+// SHIELD_COINBASE_DEFAULT_LIMIT. The byte estimate alone is not a safe bound:
+// with a P2PKH coinbase (-mineraddress) the 148-byte figure is exact rather than
+// conservative, so an under-estimate translates directly into an oversize tx.
+// The remainder is simply shielded on the next round.
+static const size_t AUTOSHIELD_MAX_INPUTS = 400;
 static const size_t AUTOSHIELD_CTXIN_P2SH_SIZE = 400;
 // Expire unmined autoshield txs after this many blocks, so a tx cannot straddle
 // a network-upgrade activation.
@@ -258,6 +270,27 @@ bool AsyncRPCOperation_autoshieldcoinbase::main_impl() {
     libzcash::SaplingPaymentAddress destZaddr;
     std::string destStr;
     std::vector<ShieldCoinbaseUTXO> inputs;
+
+    // Proof building below runs WITHOUT cs_wallet (deliberately, so wallet RPCs
+    // are not stalled), which leaves a multi-second window in which a manual
+    // z_shieldcoinbase or z_sendmany over the same miner address would re-select
+    // these same coinbase outputs. AvailableCoins honours IsLockedCoin, so lock
+    // them for the duration exactly as z_shieldcoinbase does. RAII because there
+    // are several early returns between here and commit, and a leaked lock would
+    // silently exclude those coins from every future round.
+    struct ScopedCoinLocks {
+        std::vector<COutPoint> locked;
+        ~ScopedCoinLocks() {
+            // A destructor is noexcept by default; letting the lock acquisition
+            // escape would turn a contended mutex into std::terminate.
+            try {
+                if (locked.empty()) return;
+                LOCK2(cs_main, pwalletMain->cs_wallet);
+                // UnlockCoin takes a non-const reference (upstream signature).
+                for (COutPoint& op : locked) pwalletMain->UnlockCoin(op);
+            } catch (...) {}
+        }
+    } coinLocks;
     CAmount shieldedValue      = 0;
     unsigned int max_tx_size   = MAX_TX_SIZE_AFTER_SAPLING;
 
@@ -280,7 +313,7 @@ bool AsyncRPCOperation_autoshieldcoinbase::main_impl() {
         // AvailableCoins with fOnlySpendable already excludes immature coinbase
         // (< COINBASE_MATURITY) and outputs we don't own, so external
         // -mineraddress / pool coinbase naturally yields zero inputs.
-        size_t estimatedTxSize = 2000; // header + sietch outputs headroom
+        size_t estimatedTxSize = AUTOSHIELD_TX_OVERHEAD;
         std::vector<COutput> vecOutputs;
         pwalletMain->AvailableCoins(vecOutputs, true, NULL, false, true);
         for (const COutput& out : vecOutputs) {
@@ -293,6 +326,11 @@ bool AsyncRPCOperation_autoshieldcoinbase::main_impl() {
             }
             size_t increase = (boost::get<CScriptID>(&address) != nullptr)
                                   ? AUTOSHIELD_CTXIN_P2SH_SIZE : AUTOSHIELD_CTXIN_DUST_SIZE;
+            if (inputs.size() >= AUTOSHIELD_MAX_INPUTS) {
+                LogPrintf("%s: reached per-round input cap (%d); deferring remaining coinbase to next round\n",
+                          opid, (int)AUTOSHIELD_MAX_INPUTS);
+                break;
+            }
             if (estimatedTxSize + increase >= max_tx_size) {
                 // Size-safe batch; the remainder is shielded next round.
                 LogPrintf("%s: reached per-tx size cap; deferring remaining coinbase to next round\n", opid);
@@ -305,6 +343,12 @@ bool AsyncRPCOperation_autoshieldcoinbase::main_impl() {
             inputs.push_back(utxo);
             shieldedValue += out.tx->vout[out.i].nValue;
         }
+
+        for (const ShieldCoinbaseUTXO& t : inputs) {
+            COutPoint outpt(t.txid, t.vout);
+            pwalletMain->LockCoin(outpt);
+            coinLocks.locked.push_back(outpt);
+        }
     }
 
     CAmount fee = pwalletMain->autoShieldFee;