Opt out of automounting token for a serviceaccount in Kubernetes

In the SA definition:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: bot
automountServiceAccountToken: false
...

And the same for a particular pod:

apiVersion: v1
kind: Pod
metadata:
  name: pod
spec:
  serviceAccountName: bot
  automountServiceAccountToken: false
...

The pod spec takes precedence over the serviceaccount in both specify automountServiceAccountToken