@@ -98,6 +98,22 @@ func NewDiffStore(
 		// buildData will be deleted by calling buildData.Close()
 		defer ds.resetDelete(item.Key())
 
+		// A deferred diff whose background seal hasn't resolved would block Close()
+		// on the reflink; close it off the eviction goroutine so this callback
+		// isn't stalled. Bounded (the seal always resolves) and only reachable if
+		// the TTL is shortened below the seal time — the disk-pressure eviction
+		// path already skips unsealed diffs (see deferredDiff.sealed()).
+		if dd, ok := buildData.(*deferredDiff); ok && !dd.sealed() {
+			logCtx := context.WithoutCancel(ctx)
+			go func() {
+				if closeErr := dd.Close(); closeErr != nil {
+					logger.L().Warn(logCtx, "failed to close unsealed deferred diff", zap.Any("item_key", item.Key()), zap.Error(closeErr))
+				}
+			}()
+
+			return
+		}
+
 		if closeErr := buildData.Close(); closeErr != nil {
 			logger.L().Warn(ctx, "failed to cleanup build data cache for item", zap.Any("item_key", item.Key()), zap.Error(closeErr))
 		}
@@ -311,6 +327,14 @@ func (s *DiffStore) deleteOldestFromCache(ctx context.Context) (suc bool, e erro
 			return true
 		}
 
+		// Skip a deferred diff whose background rootfs seal hasn't resolved yet:
+		// FileSize below would block on the seal (stalling the sole eviction
+		// goroutine), and a fresh, still-sealing snapshot is exactly what a
+		// just-resumed peer needs. It becomes evictable once the seal resolves.
+		if dd, ok := item.Value().(*deferredDiff); ok && !dd.sealed() {
+			return true
+		}
+
 		sfSize, err := item.Value().FileSize(ctx)
 		if err != nil {
 			logger.L().Warn(ctx, "failed to get size of deleted item from cache", zap.Error(err))
 
@@ -31,6 +31,7 @@ import (
 	blockmetrics "github.com/e2b-dev/infra/packages/orchestrator/pkg/sandbox/block/metrics"
 	"github.com/e2b-dev/infra/packages/shared/pkg/featureflags"
 	"github.com/e2b-dev/infra/packages/shared/pkg/storage/header"
+	"github.com/e2b-dev/infra/packages/shared/pkg/utils"
 )
 
 const (
@@ -716,3 +717,43 @@ func mustParseCfg(t *testing.T) cfg.Config {
 
 	return c
 }
+
+// A deferred rootfs diff whose background seal hasn't resolved must be skipped
+// by disk-pressure eviction: its data methods (FileSize) block on the seal, so
+// evicting it would stall the sole eviction goroutine, and a fresh, still-sealing
+// snapshot is exactly what a just-resumed peer needs. Once the seal resolves the
+// entry becomes evictable like any other.
+func TestDiffStoreEvictionSkipsUnsealedDeferredDiff(t *testing.T) {
+	t.Parallel()
+	cachePath := t.TempDir()
+
+	c, err := cfg.Parse()
+	require.NoError(t, err)
+	flags := flagsWithMaxBuildCachePercentage(t, 100)
+	store, err := NewDiffStore(c, flags, cachePath, 60*time.Second, 4*time.Second)
+	require.NoError(t, err)
+
+	// Oldest entry: a deferred rootfs diff whose background seal hasn't resolved.
+	promise := utils.NewSetOnce[Diff]()
+	deferred := NewDeferredDiff(GetDiffStoreKey("deferred-unsealed", Rootfs), blockSize, promise)
+	store.Add(deferred)
+
+	// A newer, ordinary diff behind it.
+	newer := newRootFSDiff(t, cachePath, "seal-newer")
+	store.Add(newer)
+
+	// Eviction must skip the unsealed deferred diff and fall through to the
+	// next-oldest instead of blocking on the seal.
+	ok, err := store.deleteOldestFromCache(t.Context())
+	require.NoError(t, err)
+	assert.True(t, ok)
+	assert.False(t, store.isBeingDeleted(deferred.CacheKey()), "unsealed deferred diff must be skipped")
+	assert.True(t, store.isBeingDeleted(newer.CacheKey()), "eviction must fall through to the next-oldest")
+
+	// Once the seal resolves, the deferred diff is evictable like any other entry.
+	require.NoError(t, promise.SetValue(newRootFSDiff(t, cachePath, "seal-resolved")))
+	ok, err = store.deleteOldestFromCache(t.Context())
+	require.NoError(t, err)
+	assert.True(t, ok)
+	assert.True(t, store.isBeingDeleted(deferred.CacheKey()), "sealed deferred diff must be evictable")
+}
@@ -53,6 +53,19 @@ func (d *deferredDiff) BlockSize() int64 {
 	return d.blockSize
 }
 
+// sealed reports, without blocking, whether the background seal has resolved the
+// promise (with the materialized diff or an error). Cache eviction uses it to
+// skip a not-yet-sealed diff rather than block on the data methods (which wait
+// on the seal) or evict a fresh, still-in-flight snapshot.
+func (d *deferredDiff) sealed() bool {
+	select {
+	case <-d.inner.Done:
+		return true
+	default:
+		return false
+	}
+}
+
 func (d *deferredDiff) CachePath(ctx context.Context) (string, error) {
 	inner, err := d.inner.WaitWithContext(ctx)
 	if err != nil {
 
@@ -11,6 +11,21 @@ import (
 	"github.com/e2b-dev/infra/packages/shared/pkg/utils"
 )
 
+// TestDeferredDiff_SealedIsNonBlocking verifies sealed() reports readiness
+// without blocking on the promise, so cache eviction can skip an unsealed diff
+// instead of stalling on it.
+func TestDeferredDiff_SealedIsNonBlocking(t *testing.T) {
+	t.Parallel()
+
+	inner := utils.NewSetOnce[Diff]()
+	d := NewDeferredDiff(GetDiffStoreKey("build-id", Rootfs), 4096, inner).(*deferredDiff)
+
+	require.False(t, d.sealed(), "unresolved promise must read as not sealed")
+
+	require.NoError(t, inner.SetValue(&NoDiff{}))
+	require.True(t, d.sealed(), "resolved promise must read as sealed")
+}
+
 // makeLocalDiff writes `data` to a fresh local diff file and materializes it.
 func makeLocalDiff(t *testing.T, blockSize int64, data []byte) Diff {
 	t.Helper()