The Tor site's page about hidden service communication mentions that a given hidden service will always use the same set of entry guards:
At this point it is of special importance that the hidden service sticks to the same set of entry guards when creating new circuits. Otherwise an attacker could run his own relay and force a hidden service to create an arbitrary number of circuits in the hope that the corrupt relay is picked as entry node and he learns the hidden server's IP address via timing analysis.
The hidden service configuration instructions don't say very much about how a service's entry guards are selected:
Now that you've restarted Tor, it is busy picking introduction points in the Tor network, and generating a hidden service descriptor. This is a signed list of introduction points along with the service's full public key.
How does the hidden service host avoid picking a "corrupt relay" as one of its permanent entry guards? What do I need to do to make sure that the guards I use are trustworthy?