diff --git a/deploy/updater/entrypoint.sh b/deploy/updater/entrypoint.sh
index 8d6108c..fe45e39 100644
--- a/deploy/updater/entrypoint.sh
+++ b/deploy/updater/entrypoint.sh
@@ -80,16 +80,32 @@ state_set_error() {
   mv "$tmp" "$STATE_FILE"
 }
 
+cleanup_legacy_lock_dirs() {
+  local locks_dir="/state/locks"
+  [[ -d "$locks_dir" ]] || return 0
+  find "$locks_dir" -mindepth 1 -maxdepth 1 -type d -exec rm -rf {} + 2>/dev/null || true
+}
+
 with_target_lock() {
   local target_id="$1"
   shift
-  local lock_dir="/state/locks/${target_id}"
-  mkdir -p "$(dirname "$lock_dir")"
-  if ! mkdir "$lock_dir" 2>/dev/null; then
-    log warn "target=${target_id} action=skip reason=lock_busy"
-    return 0
+  local lock_file="/state/locks/${target_id}.lock"
+  mkdir -p "$(dirname "$lock_file")"
+
+  if [[ -f "$lock_file" ]]; then
+    local lock_pid=""
+    lock_pid="$(tr -d '[:space:]' <"$lock_file" 2>/dev/null || true)"
+    if [[ -n "$lock_pid" ]] && kill -0 "$lock_pid" 2>/dev/null; then
+      log warn "target=${target_id} action=skip reason=lock_busy pid=${lock_pid}"
+      return 0
+    fi
+
+    log warn "target=${target_id} action=stale_lock_removed previous_pid=${lock_pid:-unknown}"
+    rm -f "$lock_file"
   fi
-  trap 'rmdir "'"$lock_dir"'" 2>/dev/null || true' RETURN
+
+  printf '%s\n' "$$" >"$lock_file"
+  trap 'rm -f "'"$lock_file"'"' RETURN
   "$@"
 }
 
@@ -483,6 +499,7 @@ main() {
 
   validate_targets_file
   state_init
+  cleanup_legacy_lock_dirs
   registry_login
 
   log info "action=startup targets_file=${TARGETS_FILE} state_file=${STATE_FILE} poll_interval=${POLL_INTERVAL_SECONDS}"