diff --git a/gen/go/protocol/protocol.go b/gen/go/protocol/protocol.go
index 7295770..8984eac 100644
--- a/gen/go/protocol/protocol.go
+++ b/gen/go/protocol/protocol.go
@@ -14,7 +14,7 @@ import (
 	"time"
 )
 
-const SchemaSHA256 = "762d009c3d25d80c3850d975e45f7a6b3fd8adf5c93c8fa7dd11dfa993f8bbb1"
+const SchemaSHA256 = "b2353c12269304289b4e872f27cc370ae61b958dea90d9fb7b6ab8afd7d37248"
 const ProtocolVersion = "1.0.0"
 const CurrentWireVersion = "2"
 const NMinus1WireVersion = "1"
diff --git a/gen/manifest.json b/gen/manifest.json
index 4ac185c..cc78852 100644
--- a/gen/manifest.json
+++ b/gen/manifest.json
@@ -14,5 +14,5 @@
   },
   "generator_sha256": "00c1905fc611ca9e226cd90da761b48b8e203734b10542befea397a30082d360",
   "protocol_version": "1.0.0",
-  "schema_sha256": "762d009c3d25d80c3850d975e45f7a6b3fd8adf5c93c8fa7dd11dfa993f8bbb1"
+  "schema_sha256": "b2353c12269304289b4e872f27cc370ae61b958dea90d9fb7b6ab8afd7d37248"
 }
diff --git a/gen/rust/protocol.rs b/gen/rust/protocol.rs
index a1179f5..6f857f1 100644
--- a/gen/rust/protocol.rs
+++ b/gen/rust/protocol.rs
@@ -1,6 +1,6 @@
 // Code generated by tools/generate.py; DO NOT EDIT.
 #![allow(non_snake_case)]
-pub const SCHEMA_SHA256: &str = "762d009c3d25d80c3850d975e45f7a6b3fd8adf5c93c8fa7dd11dfa993f8bbb1";
+pub const SCHEMA_SHA256: &str = "b2353c12269304289b4e872f27cc370ae61b958dea90d9fb7b6ab8afd7d37248";
 pub const CURRENT_WIRE_VERSION: &str = "2";
 pub const N_MINUS_1_WIRE_VERSION: &str = "1";
 pub const N_MINUS_2_WIRE_VERSION: &str = "0";
diff --git a/gen/swift/Protocol.swift b/gen/swift/Protocol.swift
index 73337cf..173a421 100644
--- a/gen/swift/Protocol.swift
+++ b/gen/swift/Protocol.swift
@@ -1,7 +1,7 @@
 // Code generated by tools/generate.py; DO NOT EDIT.
 import Foundation
 public typealias JSONObject = [String: String]
-public let schemaSHA256 = "762d009c3d25d80c3850d975e45f7a6b3fd8adf5c93c8fa7dd11dfa993f8bbb1"
+public let schemaSHA256 = "b2353c12269304289b4e872f27cc370ae61b958dea90d9fb7b6ab8afd7d37248"
 public let currentWireVersion = "2"
 public let nMinus1WireVersion = "1"
 public let nMinus2WireVersion = "0"
diff --git a/schemas/control-v1.schema.json b/schemas/control-v1.schema.json
index 602c88c..5123110 100644
--- a/schemas/control-v1.schema.json
+++ b/schemas/control-v1.schema.json
@@ -561,7 +561,7 @@
         "gateway_id": {"type": "string", "minLength": 1, "maxLength": 128},
         "audience": {"type": "string", "minLength": 1, "maxLength": 256},
         "reconnect_sequence": {"type": "integer", "minimum": 0},
-        "expires_at": {"type": "string", "format": "date-time", "maxLength": 64},
+        "expires_at": {"type": "string", "format": "date-time", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$", "maxLength": 64},
         "capabilities": {"$ref": "#/$defs/CapabilityProfile"}
       }
     },
diff --git a/tools/validate.py b/tools/validate.py
index bf71123..8ba8df6 100644
--- a/tools/validate.py
+++ b/tools/validate.py
@@ -76,6 +76,14 @@ def main() -> int:
     assert tunnel_credential["required"] == [
         "client_device_id", "device_key_id", "certificate_chain_pem", "trust_bundle_pem", "expires_at"
     ]
+    client_authority_expiry = defs["ClientSessionAuthority"]["properties"]["expires_at"]
+    assert client_authority_expiry["format"] == "date-time"
+    client_authority_expiry_pattern = re.compile(client_authority_expiry.get("pattern", r"(?!)"))
+    assert client_authority_expiry_pattern.fullmatch("2099-01-01T00:00:00Z"), "client authority expiry must accept canonical UTC"
+    for noncanonical_expiry in ("2099-01-01T00:00:00+00:00", "2099-01-01T00:00:00.100Z"):
+        assert not client_authority_expiry_pattern.fullmatch(noncanonical_expiry), (
+            f"client authority expiry accepted noncanonical UTC {noncanonical_expiry}"
+        )
 
     manifest = json.loads((ROOT / "fixtures/valid/manifest.json").read_text(encoding="utf-8"))
     assert set(manifest).issubset(set(defs["ConnectionManifest"]["properties"]))