diff --git a/ec2imds/token_provider.go b/ec2imds/token_provider.go
index deda9fba736..314c5f0e663 100644
--- a/ec2imds/token_provider.go
+++ b/ec2imds/token_provider.go
@@ -112,8 +112,9 @@ func (t *tokenProvider) HandleDeserialize(
 		return out, metadata, fmt.Errorf("expect HTTP transport, got %T", out.RawResponse)
 	}
 
-	if resp.StatusCode == 401 { // unauthorized
+	if resp.StatusCode == http.StatusUnauthorized { // unauthorized
 		err = &retryableError{Err: err}
+		t.clearToken()
 		t.enable()
 	}
 
@@ -230,3 +231,10 @@ func (t *tokenProvider) disable() {
 func (t *tokenProvider) enable() {
 	atomic.StoreUint32(&t.disabled, 0)
 }
+
+// clearToken clears the current token present
+func (t *tokenProvider) clearToken() {
+	t.tokenMux.Lock()
+	defer t.tokenMux.Unlock()
+	t.token = nil
+}