diff --git a/app/models/registrant_user.rb b/app/models/registrant_user.rb
index eeb03a3fd..ddbf2e664 100644
--- a/app/models/registrant_user.rb
+++ b/app/models/registrant_user.rb
@@ -17,29 +17,37 @@ class RegistrantUser < User
     registrant_ident.to_s.split('-').first
   end
 
+  # In Rails 5, can be replaced with a much simpler `or` query method and the raw SQL parts can be
+  # removed.
+  # https://guides.rubyonrails.org/active_record_querying.html#or-conditions
   def domains
-    Domain.uniq
-          .joins(:contacts)
-          .where(contacts: { ident_type: 'priv', ident: ident, ident_country_code: country_code })
+    domains_where_is_contact = begin
+      Domain.joins(:domain_contacts)
+            .where(domain_contacts: { contact_id: contacts })
+    end
+
+    domains_where_is_registrant = Domain.where(registrant_id: contacts)
+
+    Domain.from(
+      "(#{domains_where_is_registrant.to_sql} UNION " \
+      "#{domains_where_is_contact.to_sql}) AS domains"
+    )
   end
 
   def contacts
     Contact.where(ident_type: 'priv', ident: ident, ident_country_code: country_code)
   end
 
-  # In Rails 5, can be replaced with a much simpler `or` query method and the raw SQL parts can be
-  # removed.
-  # https://guides.rubyonrails.org/active_record_querying.html#or-conditions
   def administered_domains
     domains_where_is_administrative_contact = begin
       Domain.joins(:domain_contacts)
             .where(domain_contacts: { contact_id: contacts, type: [AdminDomainContact] })
     end
 
-    domains_where_is_registrar = Domain.where(registrant_id: contacts)
+    domains_where_is_registrant = Domain.where(registrant_id: contacts)
 
     Domain.from(
-      "(#{domains_where_is_registrar.to_sql} UNION " \
+      "(#{domains_where_is_registrant.to_sql} UNION " \
       "#{domains_where_is_administrative_contact.to_sql}) AS domains"
     )
   end
diff --git a/test/integration/api/registrant/registrant_api_registry_locks_test.rb b/test/integration/api/registrant/registrant_api_registry_locks_test.rb
index 0b7f31aad..bb50bdc1b 100644
--- a/test/integration/api/registrant/registrant_api_registry_locks_test.rb
+++ b/test/integration/api/registrant/registrant_api_registry_locks_test.rb
@@ -109,6 +109,18 @@ class RegistrantApiRegistryLocksTest < ApplicationIntegrationTest
                  response_json)
   end
 
+  def test_registrant_can_lock_a_domain
+    post '/api/v1/registrant/domains/1b3ee442-e8fe-4922-9492-8fcb9dccc69c/registry_lock',
+         {}, @auth_headers
+
+    assert_equal(200, response.status)
+    response_json = JSON.parse(response.body, symbolize_names: true)
+
+    assert(response_json[:statuses].include?(DomainStatus::SERVER_DELETE_PROHIBITED))
+    assert(response_json[:statuses].include?(DomainStatus::SERVER_TRANSFER_PROHIBITED))
+    assert(response_json[:statuses].include?(DomainStatus::SERVER_UPDATE_PROHIBITED))
+  end
+
   private
 
   def auth_token
diff --git a/test/models/registrant_user_test.rb b/test/models/registrant_user_test.rb
index 3490e35c0..298d3a096 100644
--- a/test/models/registrant_user_test.rb
+++ b/test/models/registrant_user_test.rb
@@ -13,10 +13,10 @@ class RegistrantUserTest < ActiveSupport::TestCase
 
   def test_domains_returns_an_list_of_distinct_domains_associated_with_a_specific_id_code
     domain_names = @user.domains.pluck(:name)
-    assert_equal(3, domain_names.length)
+    assert_equal(4, domain_names.length)
 
-    # User is a registrant, but not a contact for the domain.
-    refute(domain_names.include?('shop.test'))
+    # User is a registrant, but not a contact for the domain. Should be included in the list.
+    assert(domain_names.include?('shop.test'))
   end
 
   def test_administered_domains_returns_a_list_of_domains