diff --git a/nix/modules/hive-tls.nix b/nix/modules/hive-tls.nix
index e2a6d791..b55533d8 100644
--- a/nix/modules/hive-tls.nix
+++ b/nix/modules/hive-tls.nix
@@ -63,14 +63,22 @@ in
 
     leafValidityDays = lib.mkOption {
       type = lib.types.int;
-      default = 3650;
+      default = 30;
       description = ''
-        Validity window of the gateway leaf cert in days (default ~10y).
-        The leaf is re-signed by the (stable) CA when it is missing or
-        within 30 days of expiry; because it shares the CA anchor, a
-        rotation does not disturb consumer trust. Browsers may warn on
-        long-lived leaves, but agents and federation peers validate
-        against the CA, not browser CA/B-forum limits.
+        Validity window of the gateway leaf cert in days (default 30).
+        Short-lived by design — ahead of the CA/Browser-Forum's move
+        toward ~47-day max lifetimes — which bounds the blast radius of a
+        leaf-key compromise. The leaf is re-signed by the (stable) CA
+        when it is missing or near expiry; because it shares the CA
+        anchor, a rotation does not disturb consumer trust. Agents and
+        federation peers validate against the CA, not browser CA/B-forum
+        limits. NOTE: at this short a window the re-sign must run more
+        often than the leaf lifetime. Today `hive-tls-ca` re-signs at
+        service activation (boot/rebuild) only — there is no periodic
+        re-sign timer yet — so a hive that does not reboot within the
+        validity window would let the leaf expire. Keep that in mind (or
+        add a re-sign timer) when running a hive that stays up for long
+        stretches without a rebuild.
       '';
     };
   };