diff --git a/Github/Repos/Webhooks/Validate.hs b/Github/Repos/Webhooks/Validate.hs
--- a/Github/Repos/Webhooks/Validate.hs
+++ b/Github/Repos/Webhooks/Validate.hs
@@ -1,3 +1,5 @@
+{-# LANGUAGE OverloadedStrings #-}
+
 -- | Verification of incomming webhook payloads, as described at
 -- <https://developer.github.com/webhooks/securing/>
 
@@ -5,8 +7,12 @@
   isValidPayload
 ) where
 
+import Control.Applicative
 import Crypto.Hash
 import qualified Data.ByteString.Char8 as BS
+import Data.Byteable (constEqBytes, toBytes)
+import qualified Data.ByteString.Base16 as Hex
+import Data.Monoid
 
 
 -- | Validates a given payload against a given HMAC hexdigest using a given
@@ -20,7 +26,10 @@
                         -- including the 'sha1=...' prefix
   -> BS.ByteString      -- ^ the body
   -> Bool
-isValidPayload secret shaOpt payload = Just sign == shaOpt
+isValidPayload secret shaOpt payload = maybe False (constEqBytes sign) shaOptBS
   where
+    shaOptBS = BS.pack <$> shaOpt
+    hexDigest = Hex.encode . toBytes . hmacGetDigest
+
     hm = hmac (BS.pack secret) payload :: HMAC SHA1
-    sign = "sha1=" ++ (show . hmacGetDigest $ hm)
+    sign = "sha1=" <> hexDigest hm
diff --git a/github.cabal b/github.cabal
--- a/github.cabal
+++ b/github.cabal
@@ -7,7 +7,7 @@
 -- The package version. See the Haskell package versioning policy
 -- (http://www.haskell.org/haskellwiki/Package_versioning_policy) for
 -- standards guiding when and how versions should be incremented.
-Version:             0.11.1
+Version:             0.12
 
 -- A short (one-line) description of the package.
 Synopsis:            Access to the Github API, v3.
@@ -170,7 +170,9 @@
                  data-default,
                  vector,
                  unordered-containers >= 0.2 && < 0.3,
-                 cryptohash >= 0.11
+                 cryptohash >= 0.11,
+                 byteable >= 0.1.0,
+                 base16-bytestring >= 0.1.1.6
 
   -- Modules not exported by this package.
   Other-modules:       Github.Private