diff --git a/src/routes/auth.js b/src/routes/auth.js
index fcb22e3..42ce2de 100644
--- a/src/routes/auth.js
+++ b/src/routes/auth.js
@@ -43,7 +43,7 @@ function setAuthCookie(res, token) {
     httpOnly: true,
     secure: !!isProduction,  // HTTPS only in production
     sameSite: 'lax',         // Allows normal navigation, blocks CSRF from other origins
-    maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days in ms
+    maxAge: 24 * 60 * 60 * 1000, // 24 hours in ms
     path: '/'
   });
 }
@@ -224,7 +224,7 @@ router.post('/register', async (req, res) => {
     var smtpHost = await db.getSetting('smtp.host').catch(function() { return null; }) || process.env.SMTP_HOST;
     if (!smtpHost) {
       await db.run('UPDATE users SET email_verified = true, verify_token = NULL WHERE id = ?', [userId]);
-      var token = jwt.sign({ userId: userId }, JWT_SECRET, { expiresIn: '7d' });
+      var token = jwt.sign({ userId: userId }, JWT_SECRET, { expiresIn: '24h' });
       var regSessionId = generateSessionId();
       try {
         await db.run('INSERT INTO user_sessions (id, user_id, token_hash, ip_address, user_agent, device_label) VALUES (?, ?, ?, ?, ?, ?)',
@@ -345,7 +345,7 @@ router.post('/login', async (req, res) => {
       if (!verified) return res.status(401).json({ error: 'Invalid 2FA code' });
     }
 
-    var token = jwt.sign({ userId: user.id }, JWT_SECRET, { expiresIn: '7d' });
+    var token = jwt.sign({ userId: user.id }, JWT_SECRET, { expiresIn: '24h' });
     await db.run('INSERT INTO audit_log (user_id, action, ip_address) VALUES (?, ?, ?)', [user.id, 'login', req.ip]);
 
     // Create session record
diff --git a/src/routes/oidc.js b/src/routes/oidc.js
index bcead4d..86f05ca 100644
--- a/src/routes/oidc.js
+++ b/src/routes/oidc.js
@@ -70,7 +70,7 @@ function setAuthCookie(res, token) {
     httpOnly: true,
     secure: !!isProduction,
     sameSite: 'lax',
-    maxAge: 7 * 24 * 60 * 60 * 1000,
+    maxAge: 24 * 60 * 60 * 1000,  // 24 hours
     path: '/'
   });
 }
@@ -211,7 +211,7 @@ router.get('/oidc/callback', async function(req, res) {
     }
 
     // Issue JWT
-    var token = jwt.sign({ userId: user.id }, JWT_SECRET, { expiresIn: '7d' });
+    var token = jwt.sign({ userId: user.id }, JWT_SECRET, { expiresIn: '24h' });
     setAuthCookie(res, token);
 
     // Create session record