diff --git a/src/key.rs b/src/key.rs
index 651f1a3..dcd8efe 100644
--- a/src/key.rs
+++ b/src/key.rs
@@ -46,9 +46,9 @@ pub async fn key_rotation(db: &SqlitePool, cnf: &Config) -> Duration {
 			durations.push(d);
 		}
 	}
+	durations.push(Duration::from_secs(crate::KEY_CHECK_MIN_DELAY));
 	durations.sort();
-	durations.reverse();
-	durations.pop().unwrap_or(Duration::from_secs(3600))
+	durations[durations.len() - 1]
 }
 
 async fn renew_key_if_expired(
diff --git a/src/main.rs b/src/main.rs
index cfdfc8a..c878920 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -36,6 +36,7 @@ const DEFAULT_CNF_KEY_DB: &str = "key-db.sqlite3";
 const DEFAULT_CNF_REVOCATION: u64 = 1728000;
 const DEFAULT_LIB_DIR: &str = env!("VARLIBDIR");
 const DEFAULT_MSG_SIZE: usize = 1024 * 1024;
+const KEY_CHECK_MIN_DELAY: u64 = 60 * 60 * 3;
 const LOG_LEVEL_ENV_VAR: &str = "OPENSMTPD_FILTER_DKIMOUT_LOG_LEVEL";
 
 #[macro_export]