diff --git a/src/access-manager.cpp b/src/access-manager.cpp
index 056ef33..3ab89f0 100644
--- a/src/access-manager.cpp
+++ b/src/access-manager.cpp
@@ -47,6 +47,7 @@
 
   auto kek = make_shared<Data>(m_nacKey.getDefaultCertificate());
   kek->setName(Name(kekPrefix).append(nacKeyId));
+  kek->setFreshnessPeriod(DEFAULT_KEK_FRESHNESS_PERIOD);
   m_keyChain.sign(*kek, signingByIdentity(m_identity));
   // kek looks like a cert, but doesn't have ValidityPeriod
   m_ims.insert(*kek);
@@ -112,7 +113,8 @@
 
   auto kdk = make_shared<Data>(kdkName);
   kdk->setContent(content.wireEncode());
-  kdk->setFreshnessPeriod(1_h); // this can serve as soft access control for revoking access
+  // FreshnessPeriod can serve as a soft access control for revoking access
+  kdk->setFreshnessPeriod(DEFAULT_KDK_FRESHNESS_PERIOD);
   m_keyChain.sign(*kdk, signingByIdentity(m_identity));
 
   m_ims.insert(*kdk);