diff --git a/modules/gpg.nix b/modules/gpg.nix
index 9debde5..ec476bc 100644
--- a/modules/gpg.nix
+++ b/modules/gpg.nix
@@ -2,7 +2,7 @@
 # signing identity — those are personal (→ inventory). Enabling this alone is
 # harmless: a user with no key just has an idle agent.
 
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
 {
   programs.gpg = {
@@ -26,7 +26,12 @@
     # sk-based ssh keys use the normal ssh-agent; don't let gpg-agent hijack
     # SSH_AUTH_SOCK.
     enableSshSupport = false;
-    defaultCacheTtl = 1800;   # 30 min
-    maxCacheTtl = 7200;       # 2 h
+    # Idle timer, reset on every use. The hard cap runs from the unlock and
+    # never resets, so a machine in continuous use still re-asks once a workday —
+    # otherwise an unattended unlocked session signs forever.
+    # mkDefault so an inventory can dial these per machine with a plain
+    # `services.gpg-agent.defaultCacheTtl = …;` and no mkForce.
+    defaultCacheTtl = lib.mkDefault 3600;   # 1 h idle
+    maxCacheTtl = lib.mkDefault 28800;      # 8 h absolute
   };
 }