diff --git a/app/models/project.rb b/app/models/project.rb
index c0f2ab91fa4188028484b7bf9398b7c72e1d5984..3451779e18d44c65c5cea7e17ccabeffe73f10af 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -908,13 +908,13 @@ class Project < ActiveRecord::Base
   end
 
   def valid_runners_token? token
-    self.runners_token && ActiveSupport::SecurityUtils.secure_compare(token, self.runners_token)
+    self.runners_token && ActiveSupport::SecurityUtils.variable_size_secure_compare(token, self.runners_token)
   end
 
   # TODO (ayufan): For now we use runners_token (backward compatibility)
   # In 8.4 every build will have its own individual token valid for time of build
   def valid_build_token? token
-    self.builds_enabled? && self.runners_token && ActiveSupport::SecurityUtils.secure_compare(token, self.runners_token)
+    self.builds_enabled? && self.runners_token && ActiveSupport::SecurityUtils.variable_size_secure_compare(token, self.runners_token)
   end
 
   def build_coverage_enabled?
diff --git a/app/models/project_services/ci_service.rb b/app/models/project_services/ci_service.rb
index f328deda354242b1375f9c2eada1e1be892c170b..d9f0849d1470b5f316c35a49540f9b69b1df8214 100644
--- a/app/models/project_services/ci_service.rb
+++ b/app/models/project_services/ci_service.rb
@@ -26,7 +26,7 @@ class CiService < Service
   default_value_for :category, 'ci'
 
   def valid_token?(token)
-    self.respond_to?(:token) && self.token.present? && ActiveSupport::SecurityUtils.secure_compare(token, self.token)
+    self.respond_to?(:token) && self.token.present? && ActiveSupport::SecurityUtils.variable_size_secure_compare(token, self.token)
   end
 
   def supported_events