*** a/src/backend/commands/dbcommands.c
--- b/src/backend/commands/dbcommands.c
***************
*** 1944,1950 **** dbase_redo(XLogRecPtr lsn, XLogRecord *record)
--- 1944,1958 ----
  		dst_path = GetDatabasePath(xlrec->db_id, xlrec->tablespace_id);
  
  		if (InHotStandby)
+ 		{
+ 			/*
+ 			 * Lock database while we resolve conflicts to ensure that InitPostgres()
+ 			 * cannot fully re-execute concurrently. This avoids backends re-connecting
+ 			 * automatically to same database, which can happen in some cases.
+ 			 */
+ 			LockSharedObjectForSession(DatabaseRelationId, xlrec->db_id, 0, AccessExclusiveLock);
  			ResolveRecoveryConflictWithDatabase(xlrec->db_id);
+ 		}
  
  		/* Drop pages for this database that are in the shared buffer cache */
  		DropDatabaseBuffers(xlrec->db_id);
***************
*** 1960,1965 **** dbase_redo(XLogRecPtr lsn, XLogRecord *record)
--- 1968,1984 ----
  			ereport(WARNING,
  					(errmsg("some useless files may be left behind in old database directory \"%s\"",
  							dst_path)));
+ 
+ 		if (InHotStandby)
+ 		{
+ 			/*
+ 			 * Release locks prior to commit. XX There is a race condition here that may allow
+ 			 * backends to reconnect, but the window for this is small because the gap between
+ 			 * here and commit is mostly fairly small and it is unlikely that people will be
+ 			 * dropping databases that we are trying to connect to anyway.
+ 			 */
+ 			UnlockSharedObjectForSession(DatabaseRelationId, xlrec->db_id, 0, AccessExclusiveLock);
+ 		}
  	}
  	else
  		elog(PANIC, "dbase_redo: unknown op code %u", info);