diff --git a/nix/modules/hive-tls.nix b/nix/modules/hive-tls.nix
index c50d960e..b55533d8 100644
--- a/nix/modules/hive-tls.nix
+++ b/nix/modules/hive-tls.nix
@@ -63,20 +63,22 @@ in
 
     leafValidityDays = lib.mkOption {
       type = lib.types.int;
-      default = 397;
+      default = 30;
       description = ''
-        Validity window of the gateway leaf cert in days (default 397).
-        397 is just under the 398-day CA/Browser-Forum leaf cap, so
-        browsers accept it without warning, while keeping the window
-        short enough to bound the blast radius of a leaf-key compromise.
-        The leaf is re-signed by the (stable) CA when it is missing or
-        within 30 days of expiry; because it shares the CA anchor, a
-        rotation does not disturb consumer trust. Agents and federation
-        peers validate against the CA, not browser CA/B-forum limits.
-        (The previous ~10y default was pointless given that auto-rotation
-        — and long enough to make browsers complain.) Keep this
-        comfortably above the gap between gateway rebuilds, since the
-        re-sign runs at service activation, not on a standalone timer.
+        Validity window of the gateway leaf cert in days (default 30).
+        Short-lived by design — ahead of the CA/Browser-Forum's move
+        toward ~47-day max lifetimes — which bounds the blast radius of a
+        leaf-key compromise. The leaf is re-signed by the (stable) CA
+        when it is missing or near expiry; because it shares the CA
+        anchor, a rotation does not disturb consumer trust. Agents and
+        federation peers validate against the CA, not browser CA/B-forum
+        limits. NOTE: at this short a window the re-sign must run more
+        often than the leaf lifetime. Today `hive-tls-ca` re-signs at
+        service activation (boot/rebuild) only — there is no periodic
+        re-sign timer yet — so a hive that does not reboot within the
+        validity window would let the leaf expire. Keep that in mind (or
+        add a re-sign timer) when running a hive that stays up for long
+        stretches without a rebuild.
       '';
     };
   };