diff --git a/bundles/nginx/items.py b/bundles/nginx/items.py
index f2592b1..f9191aa 100644
--- a/bundles/nginx/items.py
+++ b/bundles/nginx/items.py
@@ -94,7 +94,7 @@ svc_systemd = {
 
 now = datetime.now()
 in_three_months = now + timedelta(days=90)
-default_security_expiry = in_three_months.strftime('%Y-%m-%d') + 'T00:00:00.000Z'
+default_security_expiry = in_three_months.strftime('%Y-%m') + '-01T00:00:00.000Z'
 
 for vhost, config in node.metadata.get('nginx/vhosts', {}).items():
     if not 'domain' in config: