diff --git a/pkg/serviceaccount/legacy.go b/pkg/serviceaccount/legacy.go
index 37210959fe6..1ba77ce8478 100644
--- a/pkg/serviceaccount/legacy.go
+++ b/pkg/serviceaccount/legacy.go
@@ -17,8 +17,8 @@ limitations under the License.
 package serviceaccount
 
 import (
-	"bytes"
 	"context"
+	"crypto/subtle"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -125,7 +125,7 @@ func (v *legacyValidator) Validate(ctx context.Context, tokenData string, public
 			klog.V(4).Infof("Token is deleted and awaiting removal: %s/%s for service account %s/%s", namespace, secretName, namespace, serviceAccountName)
 			return nil, errors.New("Token has been invalidated")
 		}
-		if !bytes.Equal(secret.Data[v1.ServiceAccountTokenKey], []byte(tokenData)) {
+		if subtle.ConstantTimeCompare(secret.Data[v1.ServiceAccountTokenKey], []byte(tokenData)) == 0 {
 			klog.V(4).Infof("Token contents no longer matches %s/%s for service account %s/%s", namespace, secretName, namespace, serviceAccountName)
 			return nil, errors.New("Token does not match server's copy")
 		}