diff --git a/staging/src/k8s.io/apiserver/pkg/admission/configuration/configuration_manager.go b/staging/src/k8s.io/apiserver/pkg/admission/configuration/configuration_manager.go
index d31b391c0b7..4c4bf74c92f 100644
--- a/staging/src/k8s.io/apiserver/pkg/admission/configuration/configuration_manager.go
+++ b/staging/src/k8s.io/apiserver/pkg/admission/configuration/configuration_manager.go
@@ -104,6 +104,7 @@ func (a *poller) bootstrapping() {
 	// bootstrapGracePeriod is read-only, so no lock is required
 	timer := time.NewTimer(a.bootstrapGracePeriod)
 	go func() {
+		defer timer.Stop()
 		<-timer.C
 		a.lock.Lock()
 		defer a.lock.Unlock()
diff --git a/staging/src/k8s.io/apiserver/pkg/admission/configuration/configuration_manager_test.go b/staging/src/k8s.io/apiserver/pkg/admission/configuration/configuration_manager_test.go
index 26c262e3ef6..7506b7bf076 100644
--- a/staging/src/k8s.io/apiserver/pkg/admission/configuration/configuration_manager_test.go
+++ b/staging/src/k8s.io/apiserver/pkg/admission/configuration/configuration_manager_test.go
@@ -50,6 +50,7 @@ func TestTolerateBootstrapFailure(t *testing.T) {
 	go func() {
 		// The test might have false negative, but won't be flaky
 		timer := time.NewTimer(2 * time.Second)
+		defer timer.Stop()
 		<-timer.C
 		fakeGetSucceedLock.Lock()
 		defer fakeGetSucceedLock.Unlock()