I'm wondering if you can provide a few more details about your setup:

What transaction isolation level is CRDB running in?

You can determine this by running: SHOW default_transaction_isolation;

When you're running the second transaction, are you using the same client connection in your library? Or are you opening a new one?

Are you using connection pools for your underlying connections? Also as a reference on SELECT FOR UPDATE behavior in CRDB, I'd recommend giving this a read: https://www.cockroachlabs.com/docs/stable/select-for-update