diff --git a/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c b/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c
index b65dd72f6..fa0c5cd37 100644
--- a/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c
+++ b/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c
@@ -40,7 +40,7 @@ jitter(krb5_deltat baseline, krb5_deltat *lifetime_out)
         return;
     }
 
-    *lifetime_out = baseline - offset % JITTER_WINDOW_SECONDS;
+    *lifetime_out = baseline - abs(offset) % JITTER_WINDOW_SECONDS;
 }
 
 static krb5_error_code