diff --git a/middleware.go b/middleware.go
index d209eb6..e292628 100644
--- a/middleware.go
+++ b/middleware.go
@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"maps"
 	"net/http"
-	"sync"
 
 	"github.com/jub0bs/cors/internal/headers"
 	"github.com/jub0bs/cors/internal/methods"
@@ -45,7 +44,6 @@ import (
 //
 // [CORS-preflight]: https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request
 type Middleware struct {
-	mu    sync.RWMutex // guards the other fields
 	icfg  internalConfig
 	debug bool
 }
@@ -105,29 +103,19 @@ func (m *Middleware) Reconfigure(cfg *Config) error {
 	if err != nil {
 		return err
 	}
-	m.mu.Lock()
 	{
 		m.icfg = icfg
 		// If the desired middleware is passthrough, unset m's debug mode;
 		// otherwise, leave it unchanged.
 		m.debug = cfg != nil && m.debug
 	}
-	m.mu.Unlock()
 	return nil
 }
 
 // Wrap applies the CORS middleware to the specified handler.
 func (m *Middleware) Wrap(h http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var icfg internalConfig
-		var debug bool
-		m.mu.RLock()
-		{
-			icfg = m.icfg
-			debug = m.debug
-		}
-		m.mu.RUnlock()
-		if icfg.passthrough { // passthrough middleware
+		if m.icfg.passthrough { // passthrough middleware
 			fmt.Println("passthrough")
 			h.ServeHTTP(w, r)
 			return
@@ -140,7 +128,7 @@ func (m *Middleware) Wrap(h http.Handler) http.Handler {
 		if !found {
 			// r is NOT a CORS request;
 			// see https://fetch.spec.whatwg.org/#cors-request.
-			icfg.handleNonCORS(w.Header(), isOPTIONS)
+			m.icfg.handleNonCORS(w.Header(), isOPTIONS)
 			h.ServeHTTP(w, r)
 			return
 		}
@@ -153,11 +141,11 @@ func (m *Middleware) Wrap(h http.Handler) http.Handler {
 		if isOPTIONS && found {
 			// r is a CORS-preflight request;
 			// see https://fetch.spec.whatwg.org/#cors-preflight-request.
-			icfg.handleCORSPreflight(w, r.Header, origin, originSgl, acrm, acrmSgl, debug)
+			m.icfg.handleCORSPreflight(w, r.Header, origin, originSgl, acrm, acrmSgl, m.debug)
 			return
 		}
 		// r is an "actual" (i.e. non-preflight) CORS request.
-		icfg.handleCORSActual(w, origin, originSgl, isOPTIONS)
+		m.icfg.handleCORSActual(w, origin, originSgl, isOPTIONS)
 		h.ServeHTTP(w, r)
 	})
 }
@@ -527,11 +515,9 @@ func (icfg *internalConfig) processACRH(
 // If m happens to be a passthrough middleware,
 // its debug mode is invariably off and SetDebug is a no-op.
 func (m *Middleware) SetDebug(b bool) {
-	m.mu.Lock()
 	{
 		m.debug = b
 	}
-	m.mu.Unlock()
 }
 
 // Config returns a pointer to a deep copy of m's current configuration;
@@ -546,11 +532,5 @@ func (m *Middleware) SetDebug(b bool) {
 // However, you can reconfigure a [Middleware] via its
 // [*Middleware.Reconfigure] method.
 func (m *Middleware) Config() *Config {
-	var icfg internalConfig
-	m.mu.RLock()
-	{
-		icfg = m.icfg
-	}
-	m.mu.RUnlock()
-	return newConfig(icfg)
+	return newConfig(m.icfg)
 }