diff --git a/nix/modules/hive-tls.nix b/nix/modules/hive-tls.nix
index e2a6d791..c50d960e 100644
--- a/nix/modules/hive-tls.nix
+++ b/nix/modules/hive-tls.nix
@@ -63,14 +63,20 @@ in
 
     leafValidityDays = lib.mkOption {
       type = lib.types.int;
-      default = 3650;
+      default = 397;
       description = ''
-        Validity window of the gateway leaf cert in days (default ~10y).
+        Validity window of the gateway leaf cert in days (default 397).
+        397 is just under the 398-day CA/Browser-Forum leaf cap, so
+        browsers accept it without warning, while keeping the window
+        short enough to bound the blast radius of a leaf-key compromise.
         The leaf is re-signed by the (stable) CA when it is missing or
         within 30 days of expiry; because it shares the CA anchor, a
-        rotation does not disturb consumer trust. Browsers may warn on
-        long-lived leaves, but agents and federation peers validate
-        against the CA, not browser CA/B-forum limits.
+        rotation does not disturb consumer trust. Agents and federation
+        peers validate against the CA, not browser CA/B-forum limits.
+        (The previous ~10y default was pointless given that auto-rotation
+        — and long enough to make browsers complain.) Keep this
+        comfortably above the gap between gateway rebuilds, since the
+        re-sign runs at service activation, not on a standalone timer.
       '';
     };
   };