diff --git a/README.md b/README.md
index f381489..838aeee 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,13 @@ maintenance checks can be added here over time.
 
 `scripts/check-cert-expiry.sh` checks every Let's Encrypt certificate under
 `/etc/letsencrypt/live` and sends an ntfy alert when any certificate expires in
-less than 14 days.
+less than 25 days.
+
+The threshold sits just below certbot's own renewal window. Certbot renews at 30
+days remaining, so a healthy certificate never drops below that. A 25 day
+threshold fires roughly five days after renewal first fails and still leaves 25
+days to fix it. A threshold below the renewal window means renewal has to stay
+broken for weeks before the alert trips, which is too late to be useful.
 
 ### Install
 
@@ -32,7 +38,7 @@ sudo install -m 0755 scripts/check-cert-expiry.sh /opt/scripts/check-cert-expiry
 
 ```bash
 CERT_DIR=/etc/letsencrypt/live
-EXPIRY_DAYS=14
+EXPIRY_DAYS=25
 NTFY_URL=http://127.0.0.1:2586/certbot
 ALERT_ON_NO_CERTS=true
 ```
@@ -40,7 +46,7 @@ ALERT_ON_NO_CERTS=true
 ### Overrides
 
 ```bash
-EXPIRY_DAYS=21 /opt/scripts/check-cert-expiry.sh
+EXPIRY_DAYS=40 /opt/scripts/check-cert-expiry.sh
 ```
 
 If the ntfy topic is protected with an access token:
diff --git a/scripts/check-cert-expiry.sh b/scripts/check-cert-expiry.sh
index cb0751a..9a6400c 100644
--- a/scripts/check-cert-expiry.sh
+++ b/scripts/check-cert-expiry.sh
@@ -3,7 +3,7 @@
 set -uo pipefail
 
 CERT_DIR="${CERT_DIR:-/etc/letsencrypt/live}"
-EXPIRY_DAYS="${EXPIRY_DAYS:-14}"
+EXPIRY_DAYS="${EXPIRY_DAYS:-25}"
 NTFY_URL="${NTFY_URL:-http://127.0.0.1:2586/certbot}"
 NTFY_TITLE="${NTFY_TITLE:-SSL certificate warning}"
 NTFY_PRIORITY="${NTFY_PRIORITY:-high}"