diff --git a/src/steamnetworkingsockets/clientlib/csteamnetworkingmessages.cpp b/src/steamnetworkingsockets/clientlib/csteamnetworkingmessages.cpp
index 2807017..c2c16b6 100644
--- a/src/steamnetworkingsockets/clientlib/csteamnetworkingmessages.cpp
+++ b/src/steamnetworkingsockets/clientlib/csteamnetworkingmessages.cpp
@@ -82,6 +82,8 @@ CSteamNetworkingMessages::CSteamNetworkingMessages( CSteamNetworkingSockets &ste
 
 bool CSteamNetworkingMessages::BInit()
 {
+	SteamNetworkingGlobalLock::AssertHeldByCurrentThread();
+
 	// Create listen socket
 	{
 		SteamNetworkingConfigValue_t opt[2];
diff --git a/src/steamnetworkingsockets/clientlib/csteamnetworkingsockets.cpp b/src/steamnetworkingsockets/clientlib/csteamnetworkingsockets.cpp
index 26387bf..14eb5b8 100644
--- a/src/steamnetworkingsockets/clientlib/csteamnetworkingsockets.cpp
+++ b/src/steamnetworkingsockets/clientlib/csteamnetworkingsockets.cpp
@@ -682,6 +682,8 @@ ESteamNetworkingAvailability CSteamNetworkingSockets::InitAuthentication()
 void CSteamNetworkingSockets::CheckAuthenticationPrerequisites( SteamNetworkingMicroseconds usecNow )
 {
 #ifdef STEAMNETWORKINGSOCKETS_CAN_REQUEST_CERT
+	SteamNetworkingGlobalLock::AssertHeldByCurrentThread();
+
 	// Check if we're in flight already.
 	bool bInFlight = BCertRequestInFlight();
 
@@ -783,6 +785,7 @@ void CSteamNetworkingSockets::DeduceAuthenticationStatus()
 
 void CSteamNetworkingSockets::SetAuthenticationStatus( const SteamNetAuthenticationStatus_t &newStatus )
 {
+	SteamNetworkingGlobalLock::AssertHeldByCurrentThread();
 
 	// No change?
 	bool bStatusChanged = newStatus.m_eAvail != m_AuthenticationStatus.m_eAvail;
@@ -811,6 +814,8 @@ void CSteamNetworkingSockets::SetAuthenticationStatus( const SteamNetAuthenticat
 #ifdef STEAMNETWORKINGSOCKETS_CAN_REQUEST_CERT
 void CSteamNetworkingSockets::AsyncCertRequestFinished()
 {
+	SteamNetworkingGlobalLock::AssertHeldByCurrentThread( "AsyncCertRequestFinished" );
+
 	Assert( m_msgSignedCert.has_cert() );
 	SetCertStatus( k_ESteamNetworkingAvailability_Current, "OK" );
 
@@ -824,6 +829,8 @@ void CSteamNetworkingSockets::AsyncCertRequestFinished()
 
 void CSteamNetworkingSockets::CertRequestFailed( ESteamNetworkingAvailability eCertAvail, ESteamNetConnectionEnd nConnectionEndReason, const char *pszMsg )
 {
+	SteamNetworkingGlobalLock::AssertHeldByCurrentThread( "CertRequestFailed" );
+
 	SpewWarning( "Cert request for %s failed with reason code %d.  %s\n", SteamNetworkingIdentityRender( InternalGetIdentity() ).c_str(), nConnectionEndReason, pszMsg );
 
 	// Schedule a retry.  Note that if we have active connections that need for a cert,
diff --git a/src/steamnetworkingsockets/clientlib/steamnetworkingsockets_connections.cpp b/src/steamnetworkingsockets/clientlib/steamnetworkingsockets_connections.cpp
index 708217e..0711988 100644
--- a/src/steamnetworkingsockets/clientlib/steamnetworkingsockets_connections.cpp
+++ b/src/steamnetworkingsockets/clientlib/steamnetworkingsockets_connections.cpp
@@ -315,10 +315,14 @@ CSteamNetworkPollGroup::CSteamNetworkPollGroup( CSteamNetworkingSockets *pInterf
 : m_pSteamNetworkingSocketsInterface( pInterface )
 , m_hPollGroupSelf( k_HSteamListenSocket_Invalid )
 {
+	// Object creation is rare; to keep things simple we require the global lock
+	SteamNetworkingGlobalLock::AssertHeldByCurrentThread();
 }
 
 CSteamNetworkPollGroup::~CSteamNetworkPollGroup()
 {
+	// Object deletion is rare; to keep things simple we require the global lock
+	SteamNetworkingGlobalLock::AssertHeldByCurrentThread();
 	FOR_EACH_VEC_BACK( m_vecConnections, i )
 	{
 		CSteamNetworkConnectionBase *pConn = m_vecConnections[i];
@@ -369,6 +373,9 @@ CSteamNetworkPollGroup::~CSteamNetworkPollGroup()
 
 void CSteamNetworkPollGroup::AssignHandleAndAddToGlobalTable()
 {
+	// Object creation is rare; to keep things simple we require the global lock
+	SteamNetworkingGlobalLock::AssertHeldByCurrentThread();
+
 	Assert( m_hPollGroupSelf == k_HSteamNetPollGroup_Invalid );
 
 	// We actually don't do map "lookups".  We assume the number of listen sockets
@@ -411,6 +418,7 @@ CSteamNetworkListenSocketBase::CSteamNetworkListenSocketBase( CSteamNetworkingSo
 
 CSteamNetworkListenSocketBase::~CSteamNetworkListenSocketBase()
 {
+	SteamNetworkingGlobalLock::AssertHeldByCurrentThread();
 	AssertMsg( m_mapChildConnections.Count() == 0, "Destroy() not used properly" );
 
 	// Remove us from global table, if we're in it
@@ -433,6 +441,8 @@ CSteamNetworkListenSocketBase::~CSteamNetworkListenSocketBase()
 
 bool CSteamNetworkListenSocketBase::BInitListenSocketCommon( int nOptions, const SteamNetworkingConfigValue_t *pOptions, SteamDatagramErrMsg &errMsg )
 {
+	SteamNetworkingGlobalLock::AssertHeldByCurrentThread();
+
 	Assert( m_hListenSocketSelf == k_HSteamListenSocket_Invalid );
 
 	// Assign us a handle, and add us to the global table
@@ -494,6 +504,7 @@ bool CSteamNetworkListenSocketBase::BInitListenSocketCommon( int nOptions, const
 
 void CSteamNetworkListenSocketBase::Destroy()
 {
+	SteamNetworkingGlobalLock::AssertHeldByCurrentThread();
 
 	// Destroy all child connections
 	FOR_EACH_HASHMAP( m_mapChildConnections, h )