diff --git a/.env.example b/.env.example
index abd8a1f..b149c68 100644
--- a/.env.example
+++ b/.env.example
@@ -70,6 +70,11 @@ NEXTAUTH_SECRET=replace-me-with-32-bytes-of-random
 # -----------------------------------------------------------------------------
 CLI_TOKEN_SECRET=replace-me-with-32-bytes-of-random
 
+# Lifetime (in days) of newly minted CLI tokens. Positive integer; unset or
+# invalid values fall back to 90. Only affects tokens minted after this is set —
+# already-issued tokens keep their original expiry.
+# CLI_TOKEN_TTL_DAYS=90
+
 # -----------------------------------------------------------------------------
 # App
 # -----------------------------------------------------------------------------
diff --git a/apps/web/lib/auth/cli-token.ts b/apps/web/lib/auth/cli-token.ts
index 420e1a3..02fece3 100644
--- a/apps/web/lib/auth/cli-token.ts
+++ b/apps/web/lib/auth/cli-token.ts
@@ -29,7 +29,26 @@ import { cliTokens } from "@/lib/db/schema";
 
 export const CLI_TOKEN_KID = "cli-v1";
 export const CLI_TOKEN_ISSUER = "shared-memory:cli";
-export const CLI_TOKEN_TTL_SECONDS = 60 * 60 * 24 * 30; // 30 days
+
+// Default lifetime for newly minted CLI tokens. Overridable via the
+// CLI_TOKEN_TTL_DAYS env var (must be a positive integer number of days);
+// anything unset/invalid falls back to this default. Only affects tokens
+// minted from now on — already-issued tokens keep their original `exp`.
+const DEFAULT_CLI_TOKEN_TTL_DAYS = 90;
+
+function cliTokenTtlSeconds(): number {
+  const raw = process.env.CLI_TOKEN_TTL_DAYS;
+  let days = DEFAULT_CLI_TOKEN_TTL_DAYS;
+  if (raw !== undefined && raw.trim() !== "") {
+    const parsed = Number(raw);
+    if (Number.isInteger(parsed) && parsed > 0) {
+      days = parsed;
+    }
+  }
+  return days * 60 * 60 * 24;
+}
+
+export const CLI_TOKEN_TTL_SECONDS = cliTokenTtlSeconds();
 
 function secret(): Uint8Array {
   return new TextEncoder().encode(env().CLI_TOKEN_SECRET);