diff --git a/pkg/policy/identifier.go b/pkg/policy/identifier.go
index <HASH>..<HASH> 100644
--- a/pkg/policy/identifier.go
+++ b/pkg/policy/identifier.go
@@ -67,8 +67,8 @@ func NewEndpointSet(capacity int) *EndpointSet {
 // signals to the provided WaitGroup when epFunc has been executed for each
 // endpoint.
 func (e *EndpointSet) ForEach(wg *sync.WaitGroup, epFunc func(epp Endpoint)) {
-	e.mutex.Lock()
-	defer e.mutex.Unlock()
+	e.mutex.RLock()
+	defer e.mutex.RUnlock()
 
 	wg.Add(len(e.endpoints))
pkg/policy: use Read mutex instead of Write mutex

The shared region the mutex is protecting is not being modified so there
is no point in having a Lock instead of a RLock