A better alternative is to sleep, not for a fixed time period after the end of the operation, but until a fixed amount of time after the start of the operation

A better alternative is to sleep, not for a fixed time period after the end of the operation, but until a fixed amount of time after the start of the operation (assuming the operation never takes longer than that). That way, in theory, the total time taken is independent of any variability in the timing of the operation itself. But there’s still a high risk of some side channel letting the attacker tell when the program is working and when it’s sleeping.