diff --git a/packages/backend-app-api/src/services/implementations/auth/PluginTokenHandler.ts b/packages/backend-app-api/src/services/implementations/auth/PluginTokenHandler.ts
index 14315bbf78..7e9ac4220b 100644
--- a/packages/backend-app-api/src/services/implementations/auth/PluginTokenHandler.ts
+++ b/packages/backend-app-api/src/services/implementations/auth/PluginTokenHandler.ts
@@ -130,9 +130,10 @@ export class PluginTokenHandler {
     const sub = pluginId;
     const aud = targetPluginId;
     const iat = Math.floor(Date.now() / 1000);
+    const ourExp = iat + this.keyDurationSeconds;
     const exp = onBehalfOf
-      ? Math.floor(onBehalfOf.expiresAt.getTime() / 1000)
-      : iat + this.keyDurationSeconds;
+      ? Math.min(ourExp, Math.floor(onBehalfOf.expiresAt.getTime() / 1000))
+      : ourExp;
 
     const claims = { sub, aud, iat, exp, obo: onBehalfOf?.token };
     const token = await new SignJWT(claims)