diff --git a/src/app/api/flows/cron/route.ts b/src/app/api/flows/cron/route.ts
index 5f4a226..01cf2b2 100644
--- a/src/app/api/flows/cron/route.ts
+++ b/src/app/api/flows/cron/route.ts
@@ -1,3 +1,4 @@
+import { timingSafeEqual } from 'node:crypto'
 import { NextResponse } from 'next/server'
 import { supabaseAdmin } from '@/lib/flows/admin-client'
 import { resolveFallbackPolicy } from '@/lib/flows/fallback'
@@ -30,8 +31,17 @@ export async function GET(request: Request) {
   if (!expected) {
     return NextResponse.json({ error: 'cron not configured' }, { status: 503 })
   }
-  const supplied = request.headers.get('x-cron-secret')
-  if (supplied !== expected) {
+  // Constant-time compare so an attacker who can hit the endpoint
+  // can't recover the secret byte-by-byte from response-time deltas.
+  // Length pre-check is required by timingSafeEqual (throws otherwise)
+  // and leaks only the length itself, which isn't sensitive.
+  const supplied = request.headers.get('x-cron-secret') ?? ''
+  const suppliedBuf = Buffer.from(supplied)
+  const expectedBuf = Buffer.from(expected)
+  if (
+    suppliedBuf.length !== expectedBuf.length ||
+    !timingSafeEqual(suppliedBuf, expectedBuf)
+  ) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }