diff --git a/openid-connect-client/pom.xml b/openid-connect-client/pom.xml
index 776e113ea..e6829d0c5 100644
--- a/openid-connect-client/pom.xml
+++ b/openid-connect-client/pom.xml
@@ -22,7 +22,7 @@
 	<parent>
 		<artifactId>openid-connect-parent</artifactId>
 		<groupId>org.mitre</groupId>
-		<version>1.3.6.cnaf-20230726</version>
+		<version>1.3.6.cnaf-20230914</version>
 		<relativePath>..</relativePath>
 	</parent>
 	<artifactId>openid-connect-client</artifactId>
diff --git a/openid-connect-common/pom.xml b/openid-connect-common/pom.xml
index c8a4b2b84..2ea8b7e2d 100644
--- a/openid-connect-common/pom.xml
+++ b/openid-connect-common/pom.xml
@@ -22,7 +22,7 @@
 	<parent>
 		<artifactId>openid-connect-parent</artifactId>
 		<groupId>org.mitre</groupId>
-		<version>1.3.6.cnaf-20230726</version>
+		<version>1.3.6.cnaf-20230914</version>
 		<relativePath>..</relativePath>
 	</parent>
 	<artifactId>openid-connect-common</artifactId>
diff --git a/openid-connect-server/pom.xml b/openid-connect-server/pom.xml
index 97d569fec..fb4c59b3e 100644
--- a/openid-connect-server/pom.xml
+++ b/openid-connect-server/pom.xml
@@ -23,7 +23,7 @@
 	<parent>
 		<groupId>org.mitre</groupId>
 		<artifactId>openid-connect-parent</artifactId>
-		<version>1.3.6.cnaf-20230726</version>
+		<version>1.3.6.cnaf-20230914</version>
 		<relativePath>..</relativePath>
 	</parent>
 	<build>
diff --git a/openid-connect-server/src/main/java/org/mitre/oauth2/service/impl/DefaultOAuth2ProviderTokenService.java b/openid-connect-server/src/main/java/org/mitre/oauth2/service/impl/DefaultOAuth2ProviderTokenService.java
index 022f6d77b..1aae3c6dc 100644
--- a/openid-connect-server/src/main/java/org/mitre/oauth2/service/impl/DefaultOAuth2ProviderTokenService.java
+++ b/openid-connect-server/src/main/java/org/mitre/oauth2/service/impl/DefaultOAuth2ProviderTokenService.java
@@ -219,12 +219,14 @@ public class DefaultOAuth2ProviderTokenService implements OAuth2TokenEntityServi
 
       token.setScope(scopeService.toStrings(scopes));
 
-      // make it expire if necessary
-      if (client.getAccessTokenValiditySeconds() != null
-          && client.getAccessTokenValiditySeconds() > 0) {
+      // make it always expire
+      if (client.getAccessTokenValiditySeconds() != null && client.getAccessTokenValiditySeconds() > 0) {
         Date expiration =
             new Date(System.currentTimeMillis() + (client.getAccessTokenValiditySeconds() * 1000L));
+
         token.setExpiration(expiration);
+      } else {
+        token.setExpiration(new Date(System.currentTimeMillis()));
       }
 
       // attach the authorization so that we can look it up later
diff --git a/pom.xml b/pom.xml
index 94a7a038e..46f39cb77 100644
--- a/pom.xml
+++ b/pom.xml
@@ -20,7 +20,7 @@
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>org.mitre</groupId>
 	<artifactId>openid-connect-parent</artifactId>
-	<version>1.3.6.cnaf-20230726</version>
+	<version>1.3.6.cnaf-20230914</version>
 	<name>MITREid Connect</name>
 	<packaging>pom</packaging>
 	<parent>