diff --git a/models/settings.go b/models/settings.go
index 4b2dc75..e9b6dad 100644
--- a/models/settings.go
+++ b/models/settings.go
@@ -39,6 +39,18 @@ type Settings struct {
 	// WorkflowLogRetentionDays is: absent must mean the default, not zero.
 	// Nil is 90 days, 0 is forever. Only "fixed" findings are ever swept.
 	VulnFindingRetentionDays *int `bson:"vuln_finding_retention_days,omitempty" json:"vuln_finding_retention_days,omitempty"`
+
+	// APITokenMaxDays caps how long a newly created API token may live.
+	//
+	// A pointer for the same reason the retention fields are: absent must mean
+	// the default, and the default here is no cap at all — never-expire tokens
+	// are allowed until an instance decides otherwise, so an upgrade changes
+	// nothing. Nil or 0 is no cap. A positive value refuses both a longer
+	// expiry and a token with no expiry.
+	//
+	// It is a policy on issuance, not on use: raising or lowering it never
+	// invalidates a token that already exists.
+	APITokenMaxDays *int `bson:"api_token_max_days,omitempty" json:"api_token_max_days,omitempty"`
 }
 
 // LocalLoginEnabled reads the setting with its absent-means-on default. Every
@@ -49,3 +61,13 @@ func LocalLoginEnabled(s *Settings) bool {
 	}
 	return *s.LocalLoginEnabled
 }
+
+// APITokenMaxDays reads the token lifetime cap with its absent-means-uncapped
+// default. 0 means no cap. Every caller must go through this rather than
+// dereferencing the field.
+func APITokenMaxDays(s *Settings) int {
+	if s == nil || s.APITokenMaxDays == nil || *s.APITokenMaxDays < 0 {
+		return 0
+	}
+	return *s.APITokenMaxDays
+}