diff --git a/pkg/auth/session.go b/pkg/auth/session.go
index 5705826..e8988b9 100644
--- a/pkg/auth/session.go
+++ b/pkg/auth/session.go
@@ -103,11 +103,12 @@ const defaultExpiration = 2 * time.Hour
 
 func (a *Authenticator) NewToken(r *http.Request, user provider.ProviderUser, f *Flow) TokenID {
 	id := TokenID(genUUID())
+	now := time.Now()
 
 	t := &Token{
 		ID:      id,
-		Ctime:   time.Now(),
-		Expires: time.Now().Add(defaultExpiration),
+		Ctime:   now,
+		Expires: now.Add(defaultExpiration),
 		Addr:    r.RemoteAddr,
 
 		user: user,