diff --git a/Propellor/Property/Cron.hs b/Propellor/Property/Cron.hs
index 2fa9c87..71580bc 100644
--- a/Propellor/Property/Cron.hs
+++ b/Propellor/Property/Cron.hs
@@ -3,14 +3,19 @@ module Propellor.Property.Cron where
 import Propellor
 import qualified Propellor.Property.File as File
 import qualified Propellor.Property.Apt as Apt
+import Utility.SafeCommand
 
 import Data.Char
 
 type CronTimes = String
 
--- | Installs a cron job, run as a specificed user, in a particular
---directory. Note that the Desc must be unique, as it is used for the 
---cron.d/ filename.
+-- | Installs a cron job, run as a specified user, in a particular
+-- directory. Note that the Desc must be unique, as it is used for the 
+-- cron.d/ filename.
+-- 
+-- Only one instance of the cron job is allowed to run at a time, no matter
+-- how long it runs. This is accomplished using flock locking of the cron
+-- job file.
 job :: Desc -> CronTimes -> UserName -> FilePath -> String -> Property
 job desc times user cddir command = cronjobfile `File.hasContent`
 	[ "# Generated by propellor"
@@ -18,11 +23,14 @@ job desc times user cddir command = cronjobfile `File.hasContent`
 	, "SHELL=/bin/sh"
 	, "PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
 	, ""
-	, times ++ "\t" ++ user ++ "\t" ++ "cd " ++ cddir ++ " && " ++ command
+	, times ++ "\t" ++ user ++ "\t"
+		++ "flock -n " ++ shellEscape cronjobfile
+		++ " sh -c " ++ shellEscape cmdline
 	]
 	`requires` Apt.serviceInstalledRunning "cron"
 	`describe` ("cronned " ++ desc)
   where
+	cmdline = "cd " ++ cddir ++ " && " ++ command
 	cronjobfile = "/etc/cron.d/" ++ map sanitize desc
 	sanitize c
 		| isAlphaNum c = c
diff --git a/Propellor/Property/Obnam.hs b/Propellor/Property/Obnam.hs
index 1e86158..00e0bbe 100644
--- a/Propellor/Property/Obnam.hs
+++ b/Propellor/Property/Obnam.hs
@@ -46,7 +46,7 @@ backup dir crontimes params numclients = cronjob `describe` desc
   where
 	desc = dir ++ " backed up by obnam"
 	cronjob = Cron.niceJob ("obnam_backup" ++ dir) crontimes "root" "/" $
-		intercalate ";" $ map flockcmd $ catMaybes
+		intercalate ";" $ catMaybes
 			[ if numclients == OnlyClient
 				then Just $ unwords $
 					[ "obnam"
@@ -59,7 +59,6 @@ backup dir crontimes params numclients = cronjob `describe` desc
 				, shellEscape dir
 				] ++ map shellEscape params
 			]
-	flockcmd cmd = "flock -n " ++ shellEscape dir ++ " " ++ cmd
 
 -- | Restores a directory from an obnam backup.
 --
diff --git a/config.hs b/config.hs
index ec31372..07959a0 120000
--- a/config.hs
+++ b/config.hs
@@ -1 +1 @@
-config-simple.hs
\ No newline at end of file
+config-joey.hs
\ No newline at end of file
diff --git a/debian/changelog b/debian/changelog
index 172ca7a..e7654a0 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -8,6 +8,8 @@ propellor (0.3.1) UNRELEASED; urgency=medium
   * Properties can now be satisfied differently on different operating
     systems.
   * Standard apt configuration for stable now includes backports.
+  * Cron jobs generated by propellor use flock(1) to avoid multiple
+    instances running at a time.
 
  -- Joey Hess <joeyh@debian.org>  Fri, 11 Apr 2014 15:00:11 -0400
 
diff --git a/debian/rules b/debian/rules
index dafe10f..fa44aba 100755
--- a/debian/rules
+++ b/debian/rules
@@ -1,4 +1,4 @@
-#!/usr/bin/make -f
+#!/bin/false -f
 
 # Avoid using cabal, as it writes to $HOME
 export CABAL=./Setup