diff --git a/Anvil/Tools.pm b/Anvil/Tools.pm
index 6b0373c6..6df7b561 100644
--- a/Anvil/Tools.pm
+++ b/Anvil/Tools.pm
@@ -1308,7 +1308,7 @@ sub _set_paths
 				useradd				=>	"/usr/sbin/useradd",
 				usermod				=>	"/usr/sbin/usermod",
 				uuidgen				=>	"/usr/bin/uuidgen",
-				virsh				=>	"/usr/bin/virsh",
+				virsh				=>	"/usr/sbin/anvil-virsh-wrapper",
 				'virt-install'			=>	"/usr/bin/virt-install",
 				websockify			=>	"/usr/bin/websockify",
 				wipefs				=>	"/usr/sbin/wipefs", 
diff --git a/tools/Makefile.am b/tools/Makefile.am
index 92974bba..ee9dd223 100644
--- a/tools/Makefile.am
+++ b/tools/Makefile.am
@@ -1,7 +1,5 @@
 MAINTAINERCLEANFILES	= Makefile.in
 
-# XXX recheck after rebase!
-
 dist_sbin_SCRIPTS	= \
 			  anvil-access-module \
 			  anvil-boot-server \
@@ -46,6 +44,7 @@ dist_sbin_SCRIPTS	= \
 			  anvil-update-states \
 			  anvil-update-system \
 			  anvil-version-changes \
+			  anvil-virsh-wrapper \
 			  anvil-watch-bonds \
 			  anvil-watch-drbd \
 			  anvil-watch-power \
@@ -68,7 +67,7 @@ dist_sbin_SCRIPTS	= \
 			  striker-scan-network \
 			  striker-show-db-counts \
 			  striker-update-cluster
-			  
+
 fencedir		= ${FASEXECPREFIX}/sbin
 
 dist_fence_SCRIPTS	= \
diff --git a/tools/anvil-virsh-wrapper b/tools/anvil-virsh-wrapper
new file mode 100755
index 00000000..c42bc2c4
--- /dev/null
+++ b/tools/anvil-virsh-wrapper
@@ -0,0 +1,10 @@
+#!/bin/sh -e
+
+(
+	if [ "$1" != "list" ]; then
+		virsh $@
+		exit $?
+	fi
+	flock -e 200
+	virsh $@
+) 200>/tmp/virsh.lock