diff --git a/README.rst b/README.rst
index e0cd3c1..6ce524f 100644
--- a/README.rst
+++ b/README.rst
@@ -948,6 +948,32 @@
                   lock_password: True
 .. code-block::
 
+Enhanced max_active_keys setup
+------------------------------
+
+Rotating keys too frequently, or with ``[fernet_tokens] max_active_keys`` set too low,
+will cause tokens to become invalid prior to their expiration. As tokens may be fetched
+beyond their initial expiration period, keys should not be fully rotated within the
+period of ``[token] expiration`` + ``[token] allow_expired_window`` seconds to prevent the
+tokens becoming unavailable. As an example, the max_active_keys default value can be
+adjusted according to the following specified values:
+``[token] allow_expired_window`` = 86400 (24 hours)
+``[token] expiration`` = 3600 (1 hour)
+rotation_frequency = 1 (1 hour)
+``[fernet_token]max_active_keys`` = (24 + 1)/1 + 2 = 27
+
+.. code-block:: yaml
+
+    keystone:
+      server:
+        ...
+        tokens:
+          engine: fernet
+          expiration: 3600
+          allow_expired_window: 86400
+          max_active_keys: 27
+        ...
+
 Upgrades
 ========
 
diff --git a/keystone/files/ocata/keystone.conf.Debian b/keystone/files/ocata/keystone.conf.Debian
index 55f9c7e..d7372f9 100644
--- a/keystone/files/ocata/keystone.conf.Debian
+++ b/keystone/files/ocata/keystone.conf.Debian
@@ -3072,6 +3072,9 @@
 # the built-in expiry time. This allows long running operations to succeed.
 # Defaults to two days. (integer value)
 #allow_expired_window = 172800
+{%- if server.tokens.allow_expired_window is defined %}
+allow_expired_window = {{ server.tokens.allow_expired_window }}
+{%- endif %}
 
 hash_algorithm = {{ server.hash_algorithm }}
 
diff --git a/keystone/files/pike/keystone.conf.Debian b/keystone/files/pike/keystone.conf.Debian
index 7707181..ba8c9f9 100644
--- a/keystone/files/pike/keystone.conf.Debian
+++ b/keystone/files/pike/keystone.conf.Debian
@@ -3090,6 +3090,9 @@
 # the built-in expiry time. This allows long running operations to succeed.
 # Defaults to two days. (integer value)
 #allow_expired_window = 172800
+{%- if server.tokens.allow_expired_window is defined %}
+allow_expired_window = {{ server.tokens.allow_expired_window }}
+{%- endif %}
 
 hash_algorithm = {{ server.hash_algorithm }}
 
diff --git a/keystone/files/queens/keystone.conf.Debian b/keystone/files/queens/keystone.conf.Debian
index 03ef3c9..f872c2f 100644
--- a/keystone/files/queens/keystone.conf.Debian
+++ b/keystone/files/queens/keystone.conf.Debian
@@ -1713,6 +1713,9 @@
 # for beyond the built-in expiry time. This allows long running
 # operations to succeed. Defaults to two days. (integer value)
 #allow_expired_window = 172800
+{%- if server.tokens.allow_expired_window is defined %}
+allow_expired_window = {{ server.tokens.allow_expired_window }}
+{%- endif %}
 
 hash_algorithm = {{ server.hash_algorithm }}
 
diff --git a/tests/pillar/cluster.sls b/tests/pillar/cluster.sls
index e90ae70..9b9b185 100644
--- a/tests/pillar/cluster.sls
+++ b/tests/pillar/cluster.sls
@@ -24,6 +24,7 @@
     tokens:
       engine: cache
       expiration: 86400
+      allow_expired_window: 86400
       location: /etc/keystone/fernet-keys/
     notification: false
     notification_format: cadf
diff --git a/tests/pillar/single.sls b/tests/pillar/single.sls
index 0ea2a98..3570ed1 100644
--- a/tests/pillar/single.sls
+++ b/tests/pillar/single.sls
@@ -26,6 +26,7 @@
       engine: cache
       expiration: 86400
       location: /etc/keystone/fernet-keys/
+      allow_expired_window: 86400
     notification: false
     notification_format: cadf
     security_compliance: