diff --git a/auth/src/test/java/com/baiyue/auth/config/AuthTokenTtlConfigurationContractTest.java b/auth/src/test/java/com/baiyue/auth/config/AuthTokenTtlConfigurationContractTest.java
new file mode 100644
index 000000000..8df324da5
--- /dev/null
+++ b/auth/src/test/java/com/baiyue/auth/config/AuthTokenTtlConfigurationContractTest.java
@@ -0,0 +1,22 @@
+package com.baiyue.auth.config;
+
+import org.junit.jupiter.api.Test;
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class AuthTokenTtlConfigurationContractTest {
+    @Test
+    void cnNacosConfigurationKeepsShortAccessAndSevenDayRefreshTokens() throws Exception {
+        String configuration = Files.readString(
+            Path.of("..", "config", "nacos", "cn", "auth-service.yml"), StandardCharsets.UTF_8);
+
+        assertThat(configuration)
+            .contains("access-token-ttl: ${ACCESS_TOKEN_TTL:2h}")
+            .contains("refresh-token-ttl: ${REFRESH_TOKEN_TTL:7d}")
+            .doesNotContain("access-token-ttl: ${ACCESS_TOKEN_TTL:7d}");
+    }
+}
diff --git a/config/nacos/cn/auth-service.yml b/config/nacos/cn/auth-service.yml
index 38e4be250..b7cabf2c4 100644
--- a/config/nacos/cn/auth-service.yml
+++ b/config/nacos/cn/auth-service.yml
@@ -4,3 +4,7 @@ spring:
     username: ${AUTH_DB_USERNAME}
     password: ${AUTH_DB_PASSWORD}
     driver-class-name: com.mysql.cj.jdbc.Driver
+baiyue:
+  security:
+    access-token-ttl: ${ACCESS_TOKEN_TTL:2h}
+    refresh-token-ttl: ${REFRESH_TOKEN_TTL:7d}