diff --git a/crypto/cipher/tls_cbc.cc b/crypto/cipher/tls_cbc.cc
index d34d2d6..31d3218 100644
--- a/crypto/cipher/tls_cbc.cc
+++ b/crypto/cipher/tls_cbc.cc
@@ -53,7 +53,10 @@
 
   for (size_t i = 0; i < to_check; i++) {
     uint8_t mask = constant_time_ge_8(padding_length, i);
-    uint8_t b = in[in_len - 1 - i];
+    // The value barrier on |(in_len - 1 - i)| isn't needed to enforce
+    // constant-time. It is just there to prevent a false positive in
+    // constant-time checks by valgrind.
+    uint8_t b = in[value_barrier_w(in_len - 1 - i)];
     // The final |padding_length+1| bytes should all have the value
     // |padding_length|. Therefore the XOR should be zero.
     good &= ~(mask & (padding_length ^ b));