diff --git a/services/surfaceflinger/RefreshRateOverlay.cpp b/services/surfaceflinger/RefreshRateOverlay.cpp
index 1e5c25f..5b4bec9 100644
--- a/services/surfaceflinger/RefreshRateOverlay.cpp
+++ b/services/surfaceflinger/RefreshRateOverlay.cpp
@@ -37,9 +37,16 @@
         return false;
     }
 
+    Mutex::Autolock _l(mFlinger.mStateLock);
     mLayer = mClient->getLayerUser(mIBinder);
     mLayer->setCrop_legacy(Rect(50, 70, 200, 100), true);
-    mLayer->setLayer(INT32_MAX - 2);
+
+    // setting Layer's Z requires resorting layersSortedByZ
+    ssize_t idx = mFlinger.mCurrentState.layersSortedByZ.indexOf(mLayer);
+    if (mLayer->setLayer(INT32_MAX - 2) && idx >= 0) {
+        mFlinger.mCurrentState.layersSortedByZ.removeAt(idx);
+        mFlinger.mCurrentState.layersSortedByZ.add(mLayer);
+    }
 
     return true;
 }
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 661c889..70e15c9 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -5432,9 +5432,13 @@
                 // TODO(b/129297325): expose this via developer menu option
                 n = data.readInt32();
                 if (n && !mRefreshRateOverlay) {
-                    std::lock_guard<std::mutex> lock(mActiveConfigLock);
+                    RefreshRateType type;
+                    {
+                        std::lock_guard<std::mutex> lock(mActiveConfigLock);
+                        type = mDesiredActiveConfig.type;
+                    }
                     mRefreshRateOverlay = std::make_unique<RefreshRateOverlay>(*this);
-                    mRefreshRateOverlay->changeRefreshRate(mDesiredActiveConfig.type);
+                    mRefreshRateOverlay->changeRefreshRate(type);
                 } else if (!n) {
                     mRefreshRateOverlay.reset();
                 }