Snapshots with integrity can be taken of secure workspaces having distributed cache. When a snapshot of a secure workspace is to be taken, a host agent executing external to the secure workspace can instruct a workspace agent running inside the secure workspace to lock a filesystem and flush the cache within the secure workspace. The host agent can then lock the filesystem and flush the cache outside the secure workspace. The host agent may then create a snapshot of the secure workspace. After the snapshot is created, the host agent can unlock the filesystem outside the secure workspace and instruct the workspace agent to unlock the filesystem inside the secure workspace.