diff --git a/src/quic/session.cc b/src/quic/session.cc
index dd5a992d55275c..829829a0679f7f 100644
--- a/src/quic/session.cc
+++ b/src/quic/session.cc
@@ -645,7 +645,7 @@ void Session::Destroy() {
 
   for (auto cid : cids) endpoint_->DisassociateCID(CID(&cid));
 
-  for (auto token : tokens) {
+  for (const auto& token : tokens) {
     if (token.token_present)
       endpoint_->DisassociateStatelessResetToken(
           StatelessResetToken(token.token));