diff --git a/manifests/init.pp b/manifests/init.pp
index a484d5b9..ce05b259 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -341,6 +341,10 @@
 #    the user is logged out.
 #    Defaults to 1800.
 #
+#  [*token_timeout_margin*]
+#    (optional) A time margin in seconds to subtract from the real token's validity.
+#    Defaults to 0.
+#
 #  [*timezone*]
 #    (optional) The timezone of the server.
 #    Defaults to 'UTC'.
@@ -593,6 +597,7 @@ class horizon(
   Stdlib::Absolutepath $root_path                   = "${::horizon::params::static_path}/openstack-dashboard",
   $access_log_format                                = undef,
   $session_timeout                                  = 1800,
+  $token_timeout_margin                             = 0,
   $timezone                                         = 'UTC',
   Boolean $secure_cookies                           = false,
   $django_session_engine                            = undef,
diff --git a/releasenotes/notes/token_timeout_margin-33c86659acbcad13.yaml b/releasenotes/notes/token_timeout_margin-33c86659acbcad13.yaml
new file mode 100644
index 00000000..ebc6af80
--- /dev/null
+++ b/releasenotes/notes/token_timeout_margin-33c86659acbcad13.yaml
@@ -0,0 +1,4 @@
+---
+features:
+  - |
+    The new ``horizon::token_timeout_margin`` parameter has been added.
diff --git a/spec/classes/horizon_init_spec.rb b/spec/classes/horizon_init_spec.rb
index 0b7b9f95..85f3af70 100644
--- a/spec/classes/horizon_init_spec.rb
+++ b/spec/classes/horizon_init_spec.rb
@@ -72,6 +72,8 @@ describe 'horizon' do
           'OPENSTACK_KEYSTONE_DEFAULT_ROLE = "member"',
           'TIME_ZONE = "UTC"',
           "            'handlers': ['file'],",
+          'SESSION_TIMEOUT = 1800',
+          'TOKEN_TIMEOUT_MARGIN = 0',
           'COMPRESS_OFFLINE = True',
           "FILE_UPLOAD_TEMP_DIR = '/tmp'",
         ])
@@ -132,6 +134,7 @@ describe 'horizon' do
           :keystone_default_domain          => 'domain.tld',
           :overview_days_range              => 1,
           :session_timeout                  => 1800,
+          :token_timeout_margin             => 60,
           :timezone                         => 'Asia/Shanghai',
           :available_themes                 => [
             { 'name' => 'default', 'label' => 'Default', 'path' => 'themes/default' },
@@ -219,6 +222,7 @@ describe 'horizon' do
           "            'level': 'DEBUG',",
           "            'handlers': ['console', 'syslog'],",
           'SESSION_TIMEOUT = 1800',
+          'TOKEN_TIMEOUT_MARGIN = 60',
           'COMPRESS_OFFLINE = False',
           "FILE_UPLOAD_TEMP_DIR = '/var/spool/horizon'",
           'OVERVIEW_DAYS_RANGE = 1',
diff --git a/templates/local_settings.py.erb b/templates/local_settings.py.erb
index 14957929..a649c618 100644
--- a/templates/local_settings.py.erb
+++ b/templates/local_settings.py.erb
@@ -1056,6 +1056,8 @@ SECURITY_GROUP_RULES = {
 
 SESSION_TIMEOUT = <%= @session_timeout %>
 
+TOKEN_TIMEOUT_MARGIN = <%= @token_timeout_margin %>
+
 # The Ubuntu package includes pre-compressed JS and compiled CSS to allow
 # offline compression by default.  To enable online compression, install
 # the python-lesscpy package and disable the following option.