OBJECTIVES: To explore health-worker perspectives on security, improving safety, managing constrained resources and handling mass casualties during besiegement in Syria. DESIGN: A qualitative study using semi-structured key informant interviews, conducted remotely over WhatsApp and Skype, and analysed thematically using inductive coding. SETTING: Secondary and tertiary health facilities affected by besiegement in Aleppo (from July to December 2016) and Rural Damascus (from August 2013 to February 2018). PARTICIPANTS: Twenty-one male Syrian health-workers and service-users who had experienced besiegement and targeting of their health facilities. RESULTS: Participants described four related challenges of: (i) conflict-related responses, particularly responding to mass casualties; (ii) targeted attack responses, particularly preventing/surviving facility bombings; (iii) besiegement responses, particularly mitigating severe resource constraints; and (iv) chronic risk responses, particularly maintaining emotional resilience. Mass casualty response involved triage and training to prioritise mortality reduction and available resources, for example those with greatest need and likelihood of survival. Targeting response was largely physical, including fortification, working underground, reducing visibility and services dispersal. Besiegement response required resource conservation, for example, controlling consumption, reusing consumables, low-technology equipment, finding alternative supply routes, stockpiling and strengthening available human resources through online trainings and establishing a medical school in Ghouta. Risk responses included managing safety worries, finding value in work and maintaining hope. CONCLUSION: Besieged health-workers were most affected by severe resource constraints and safety concerns while responding to overwhelming mass casualty events. Lessons for targeting/besiegement planning include training staff and preparing for: (i) mass casualties, through local/online health-worker training in triage, emergency response and resource conservation; allowing task-shifting; and providing access to low-technology equipment; (ii) attacks, through strengthened facility security, for example, protection and deterrence through fortification, working underground and reducing visibility; and (iii) besiegement, through ensuring access to internet, electricity and low-technology/reusable equipment; securely stockpiling fuel, medicines and supplies; and establishing alternative supply routes.