diff --git a/storage/kubernetes/client.go b/storage/kubernetes/client.go
index 9f5d0d3f7843e5045214c051fd0d9d130ea92e89..55e319d7d7cfffdae15ba68e165717140fb606f4 100644
--- a/storage/kubernetes/client.go
+++ b/storage/kubernetes/client.go
@@ -72,9 +72,10 @@ func idToName(s string, h func() hash.Hash) string {
 }
 
 func offlineTokenName(userID string, connID string, h func() hash.Hash) string {
-	h().Write([]byte(userID))
-	h().Write([]byte(connID))
-	return strings.TrimRight(encoding.EncodeToString(h().Sum(nil)), "=")
+	hash := h()
+	hash.Write([]byte(userID))
+	hash.Write([]byte(connID))
+	return strings.TrimRight(encoding.EncodeToString(hash.Sum(nil)), "=")
 }
 
 func (c *client) urlFor(apiVersion, namespace, resource, name string) string {
diff --git a/storage/kubernetes/client_test.go b/storage/kubernetes/client_test.go
index 01b4eb7a9b25f567c8f60c05b54e11183dea5f77..5793d7d1b3d6314b566bee470953f06a6b8937d4 100644
--- a/storage/kubernetes/client_test.go
+++ b/storage/kubernetes/client_test.go
@@ -29,6 +29,19 @@ func TestIDToName(t *testing.T) {
 	wg.Wait()
 }
 
+func TestOfflineTokenName(t *testing.T) {
+	h := func() hash.Hash { return fnv.New64() }
+
+	userID1 := "john"
+	userID2 := "jane"
+
+	id1 := offlineTokenName(userID1, "local", h)
+	id2 := offlineTokenName(userID2, "local", h)
+	if id1 == id2 {
+		t.Errorf("expected offlineTokenName to produce different hashes")
+	}
+}
+
 func TestNamespaceFromServiceAccountJWT(t *testing.T) {
 	namespace, err := namespaceFromServiceAccountJWT(serviceAccountToken)
 	if err != nil {