diff --git a/crates/tranquil-api/src/moderation/mod.rs b/crates/tranquil-api/src/moderation/mod.rs
index 27119bb..ece9885 100644
--- a/crates/tranquil-api/src/moderation/mod.rs
+++ b/crates/tranquil-api/src/moderation/mod.rs
@@ -153,6 +153,7 @@ async fn proxy_to_report_service(
         &auth_user.did,
         &DidRef::from(service_did),
         Some(&CREATE_REPORT_NSID),
+        None,
         &key_bytes,
     ) {
         Ok(t) => t,
diff --git a/crates/tranquil-api/src/server/service_auth.rs b/crates/tranquil-api/src/server/service_auth.rs
index 5b66b27..f98cc5d 100644
--- a/crates/tranquil-api/src/server/service_auth.rs
+++ b/crates/tranquil-api/src/server/service_auth.rs
@@ -146,8 +146,6 @@ pub async fn get_service_auth(
         .into_response();
     }
 
-    // NOTE: exp is validated here but never reaches create_service_token, which hardcodes a 60
-    // second lifetime, so a client asking for longer silently gets 60 seconds
     if let Some(exp) = params.exp {
         let now = chrono::Utc::now().timestamp();
         let diff = exp - now;
@@ -172,7 +170,13 @@ pub async fn get_service_auth(
     }
 
     let service_token =
-        match tranquil_pds::auth::create_service_token(&auth.did, &params.aud, lxm, &key_bytes) {
+        match tranquil_pds::auth::create_service_token(
+            &auth.did,
+            &params.aud,
+            lxm,
+            params.exp,
+            &key_bytes,
+        ) {
             Ok(t) => t,
             Err(e) => {
                 error!("Failed to create service token: {:?}", e);
diff --git a/crates/tranquil-auth/src/token.rs b/crates/tranquil-auth/src/token.rs
index 8a851cc..eabc127 100644
--- a/crates/tranquil-auth/src/token.rs
+++ b/crates/tranquil-auth/src/token.rs
@@ -129,14 +129,18 @@ pub fn create_service_token(
     did: &Did,
     aud: &DidRef,
     lxm: Option<&Nsid>,
+    exp: Option<i64>,
     key_bytes: &[u8],
 ) -> Result<String> {
     let signing_key = SigningKey::from_slice(key_bytes)?;
 
-    let expiration = Utc::now()
-        .checked_add_signed(Duration::seconds(60))
-        .expect("valid timestamp")
-        .timestamp();
+    let expiration = match exp {
+        Some(exp) => exp,
+        None => Utc::now()
+            .checked_add_signed(Duration::seconds(60))
+            .expect("valid timestamp")
+            .timestamp(),
+    };
 
     let claims = Claims {
         iss: did.clone(),
diff --git a/crates/tranquil-pds/src/api/proxy.rs b/crates/tranquil-pds/src/api/proxy.rs
index 5d5c638..39f4406 100644
--- a/crates/tranquil-pds/src/api/proxy.rs
+++ b/crates/tranquil-pds/src/api/proxy.rs
@@ -363,6 +363,7 @@ async fn proxy_handler(
                     &auth_user.did,
                     &DidRef::from(&token_aud),
                     Some(&token_lxm),
+                    None,
                     &key_bytes,
                 ) {
                     Ok(new_token) => {
diff --git a/crates/tranquil-pds/tests/jwt_security.rs b/crates/tranquil-pds/tests/jwt_security.rs
index c899b95..9decaeb 100644
--- a/crates/tranquil-pds/tests/jwt_security.rs
+++ b/crates/tranquil-pds/tests/jwt_security.rs
@@ -171,6 +171,7 @@ fn test_token_type_confusion() {
         &did,
         &DidRef::new("did:web:nel.pet").expect("valid DID reference"),
         Some(&Nsid::new("cafe.oyster.method").expect("valid NSID")),
+        None,
         &key_bytes,
     )
     .unwrap();