diff --git a/CHANGES.txt b/CHANGES.txt
index cee49bff43..2cd0eb07f4 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,7 +1,6 @@
 3.10
  * Fix inconsistencies in cassandra-stress load balancing policy (CASSANDRA-12919)
  * Fix validation of non-frozen UDT cells (CASSANDRA-12916)
- * AnticompactionRequestSerializer serializedSize is incorrect (CASSANDRA-12934)
  * Don't shut down socket input/output on StreamSession (CASSANDRA-12903)
  * Fix Murmur3PartitionerTest (CASSANDRA-12858)
  * Move cqlsh syntax rules into separate module and allow easier customization (CASSANDRA-12897)
@@ -106,6 +105,8 @@
  * Restore resumable hints delivery (CASSANDRA-11960)
  * Properly report LWT contention (CASSANDRA-12626)
 Merged from 3.0:
+ * LocalToken ensures token values are cloned on heap (CASSANDRA-12651)
+ * AnticompactionRequestSerializer serializedSize is incorrect (CASSANDRA-12934)
  * Prevent reloading of logback.xml from UDF sandbox (CASSANDRA-12535)
  * Pass root cause to CorruptBlockException when uncompression failed (CASSANDRA-12889)
  * Batch with multiple conditional updates for the same partition causes AssertionError (CASSANDRA-12867)
diff --git a/src/java/org/apache/cassandra/dht/LocalPartitioner.java b/src/java/org/apache/cassandra/dht/LocalPartitioner.java
index 0a9b7cbfb7..168601ca3e 100644
--- a/src/java/org/apache/cassandra/dht/LocalPartitioner.java
+++ b/src/java/org/apache/cassandra/dht/LocalPartitioner.java
@@ -28,10 +28,11 @@ import org.apache.cassandra.db.CachedHashDecoratedKey;
 import org.apache.cassandra.db.marshal.AbstractType;
 import org.apache.cassandra.utils.ByteBufferUtil;
 import org.apache.cassandra.utils.ObjectSizes;
+import org.apache.cassandra.utils.memory.HeapAllocator;
 
 public class LocalPartitioner implements IPartitioner
 {
-    private static final long EMPTY_SIZE = ObjectSizes.measure(new LocalPartitioner(null).new LocalToken(null));
+    private static final long EMPTY_SIZE = ObjectSizes.measure(new LocalPartitioner(null).new LocalToken());
 
     final AbstractType<?> comparator;   // package-private to avoid access workarounds in embedded LocalToken.
 
@@ -132,9 +133,14 @@ public class LocalPartitioner implements IPartitioner
     {
         static final long serialVersionUID = 8437543776403014875L;
 
+        private LocalToken()
+        {
+            super(null);
+        }
+
         public LocalToken(ByteBuffer token)
         {
-            super(token);
+            super(HeapAllocator.instance.clone(token));
         }
 
         @Override