diff --git a/internal/mcp/code.go b/internal/mcp/code.go
index a728b2d1a..d3a317f04 100644
--- a/internal/mcp/code.go
+++ b/internal/mcp/code.go
@@ -20,6 +20,10 @@ func CreateCode(
 	ad string,
 	cipher cipher.AEAD,
 ) (string, error) {
+	if expires.IsZero() {
+		return "", fmt.Errorf("validate: zero expiration")
+	}
+
 	v := oauth21proto.Code{
 		Id:        id,
 		ExpiresAt: timestamppb.New(expires),