diff --git a/src/Simplex/Messaging/Notifications/Server/Push/WebPush.hs b/src/Simplex/Messaging/Notifications/Server/Push/WebPush.hs
index 704726380..7794deb47 100644
--- a/src/Simplex/Messaging/Notifications/Server/Push/WebPush.hs
+++ b/src/Simplex/Messaging/Notifications/Server/Push/WebPush.hs
@@ -68,7 +68,8 @@ getVapidHeader vapidK cache uriAuthority = do
   now <- systemSeconds <$> getSystemTime
   case h of
     Nothing -> newCacheEntry now
-    Just entry -> if expire entry > now then pure $ vapidHeader entry
+    -- if it expires in 1 min, then we renew - for safety
+    Just entry -> if expire entry > now + 60 then pure $ vapidHeader entry
       else newCacheEntry now
   where
     newCacheEntry :: Int64 -> IO B.ByteString