diff --git a/inventories/default.nix b/inventories/default.nix
index 9187214e..6253924b 100644
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -117,6 +117,9 @@
           roles.bootstrap.tags = [ "dm-bootstrapper" ];
           roles.default.tags = [ "all" ];
           roles.default.settings.interfaces = [ "ygg" ];
+          # default 2160h (90d) expired cluster-wide on 2026-10-20; node certs
+          # are only re-signed when `clan vars generate --regenerate` is run.
+          roles.default.settings.certificateValidity = "87600h";
         };
 
         auto-pull-update = {