diff --git a/vendor.conf b/vendor.conf
index d9f11f86b7..0a51cc72a6 100644
--- a/vendor.conf
+++ b/vendor.conf
@@ -144,7 +144,7 @@ github.com/klauspost/compress                       a3b7545c88eea469c2246bee0e6c
 github.com/pelletier/go-toml                        65ca8064882c8c308e5c804c5d5443d409e0738c # v1.8.1
 
 # cluster
-github.com/docker/swarmkit                          ccf0585f543eae7d74104ddd8f339a960322d214 # master
+github.com/docker/swarmkit                          2dcf70aafdc9ea55af3aaaeca440638cde0ecda6  # master
 github.com/gogo/protobuf                            b03c65ea87cdc3521ede29f62fe3ce239267c1bc # v1.3.2
 github.com/golang/protobuf                          84668698ea25b64748563aa20726db66a6b8d299 # v1.3.5
 github.com/cloudflare/cfssl                         5d63dbd981b5c408effbb58c442d54761ff94fbd # 1.3.2
diff --git a/vendor/github.com/docker/swarmkit/manager/logbroker/subscription.go b/vendor/github.com/docker/swarmkit/manager/logbroker/subscription.go
index 883ddce655..45295bb40a 100644
--- a/vendor/github.com/docker/swarmkit/manager/logbroker/subscription.go
+++ b/vendor/github.com/docker/swarmkit/manager/logbroker/subscription.go
@@ -204,20 +204,31 @@ func (s *subscription) watch(ch <-chan events.Event) error {
 	}
 
 	add := func(t *api.Task) {
+		// this mutex does not have a deferred unlock, because there is work
+		// we need to do after we release it.
 		s.mu.Lock()
-		defer s.mu.Unlock()
 
 		// Un-allocated task.
 		if t.NodeID == "" {
 			s.pendingTasks[t.ID] = struct{}{}
+			s.mu.Unlock()
 			return
 		}
 
 		delete(s.pendingTasks, t.ID)
 		if _, ok := s.nodes[t.NodeID]; !ok {
 			s.nodes[t.NodeID] = struct{}{}
+
+			s.mu.Unlock()
+
+			// if we try to call Publish before we release the lock, we can end
+			// up in a situation where the receiver is trying to acquire a read
+			// lock on it. it's hard to explain.
 			s.changed.Publish(s)
+			return
 		}
+
+		s.mu.Unlock()
 	}
 
 	for {