diff --git a/internal/gateway/apikey.go b/internal/gateway/apikey.go
index 52ba3cb6..2f9feb92 100644
--- a/internal/gateway/apikey.go
+++ b/internal/gateway/apikey.go
@@ -334,6 +334,7 @@ func invalidAPIKeyAuthError(err error) *apiError {
 }
 
 func hashAPIKey(key string) string {
-	sum := sha256.Sum256([]byte(key))
-	return base64.RawURLEncoding.EncodeToString(sum[:])
+	mac := hmac.New(sha256.New, pepperKey)
+	mac.Write([]byte(key))
+	return base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
 }