diff --git a/src/main/java/com/googlesource/gerrit/plugins/websession/flatfile/FlatFileWebSessionCache.java b/src/main/java/com/googlesource/gerrit/plugins/websession/flatfile/FlatFileWebSessionCache.java
index f6726ed..55c3230 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/websession/flatfile/FlatFileWebSessionCache.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/websession/flatfile/FlatFileWebSessionCache.java
@@ -31,6 +31,9 @@
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.StandardCopyOption;
+import java.time.Clock;
+import java.time.Instant;
+import java.time.ZoneId;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
@@ -47,6 +50,31 @@
 public class FlatFileWebSessionCache implements Cache<String, WebSessionManager.Val> {
   private static final Logger log = LoggerFactory.getLogger(FlatFileWebSessionCache.class);
 
+  /** Provides static methods to set the system clock for testing purposes only. */
+  static class TimeMachine {
+    private static Clock clock = Clock.systemDefaultZone();
+
+    private TimeMachine() {
+      throw new IllegalAccessError("Utility class. Not meant to be instantiated.");
+    }
+
+    static Instant now() {
+      return Instant.now(getClock());
+    }
+
+    static void useFixedClockAt(Instant instant) {
+      clock = Clock.fixed(instant, ZoneId.systemDefault());
+    }
+
+    static void useSystemDefaultZoneClock() {
+      clock = Clock.systemDefaultZone();
+    }
+
+    private static Clock getClock() {
+      return clock;
+    }
+  }
+
   private final Path dir;
 
   @Inject
@@ -78,9 +106,11 @@
   public void cleanUp() {
     for (Path path : listFiles()) {
       Val val = readFile(path);
-      long expires = val.getExpiresAt();
-      if (expires < System.currentTimeMillis()) {
-        deleteFile(path);
+      if (val != null) {
+        Instant expires = Instant.ofEpochMilli(val.getExpiresAt());
+        if (expires.isBefore(TimeMachine.now())) {
+          deleteFile(path);
+        }
       }
     }
   }
diff --git a/src/test/java/com/googlesource/gerrit/plugins/websession/flatfile/FlatFileWebSessionCacheTest.java b/src/test/java/com/googlesource/gerrit/plugins/websession/flatfile/FlatFileWebSessionCacheTest.java
index 7a24bd4..1bafca8 100644
--- a/src/test/java/com/googlesource/gerrit/plugins/websession/flatfile/FlatFileWebSessionCacheTest.java
+++ b/src/test/java/com/googlesource/gerrit/plugins/websession/flatfile/FlatFileWebSessionCacheTest.java
@@ -18,6 +18,7 @@
 
 import com.google.common.collect.ImmutableMap;
 import com.google.gerrit.httpd.WebSessionManager.Val;
+import com.googlesource.gerrit.plugins.websession.flatfile.FlatFileWebSessionCache.TimeMachine;
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.file.DirectoryStream;
@@ -28,6 +29,8 @@
 import java.nio.file.SimpleFileVisitor;
 import java.nio.file.StandardCopyOption;
 import java.nio.file.attribute.BasicFileAttributes;
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
@@ -84,8 +87,20 @@
   @Test
   public void cleanUpTest() throws Exception {
     loadExistingKeyToCacheDir();
-    flatFileWebSessionCache.cleanUp();
-    assertThat(isDirEmpty(dir)).isTrue();
+    try {
+      long existingKeyExpireAt = flatFileWebSessionCache.getIfPresent(existingKey).getExpiresAt();
+      TimeMachine.useFixedClockAt(
+          Instant.ofEpochMilli(existingKeyExpireAt).minus(1, ChronoUnit.HOURS));
+      flatFileWebSessionCache.cleanUp();
+      assertThat(isDirEmpty(dir)).isFalse();
+
+      TimeMachine.useFixedClockAt(
+          Instant.ofEpochMilli(existingKeyExpireAt).plus(1, ChronoUnit.HOURS));
+      flatFileWebSessionCache.cleanUp();
+      assertThat(isDirEmpty(dir)).isTrue();
+    } finally {
+      TimeMachine.useSystemDefaultZoneClock();
+    }
   }
 
   @Test