diff --git a/spn/hub/update.go b/spn/hub/update.go
index e2009db4..4e280b1a 100644
--- a/spn/hub/update.go
+++ b/spn/hub/update.go
@@ -22,7 +22,7 @@ var (
 				Remove(jess.Integrity)                // Only applies to decryption.
 	// SenderAuthentication provides pre-decryption integrity. That is all we need.
 
-	clockSkewTolerance = 1 * time.Hour
+	clockSkewTolerance = 12 * time.Hour
 )
 
 // SignHubMsg signs the given serialized hub msg with the given configuration.