diff --git a/apps/api/src/server.ts b/apps/api/src/server.ts
index 34d7a46..f1386f3 100644
--- a/apps/api/src/server.ts
+++ b/apps/api/src/server.ts
@@ -122,7 +122,8 @@ export const app = new Elysia()
 
     // AUTHENTICATION
     .post("/auth/login", async ({ jwt, body, cookie: { auth } }) => {
-        if (body.password !== env.ADMIN_PASSWORD) throw status(401, "Invalid credentials");
+        const match = crypto.timingSafeEqual(Buffer.from(body.password, "hex"), Buffer.from(env.ADMIN_PASSWORD, "hex"));
+        if (!match) throw status(401, "Invalid credentials");
 
         auth.set({
             value: await jwt.sign({ sessionId: randomUUIDv7(), exp: JWT_EXP }),