diff --git a/.changeset/shaggy-ghosts-bake.md b/.changeset/shaggy-ghosts-bake.md
new file mode 100644
index 0000000..9254fd6
--- /dev/null
+++ b/.changeset/shaggy-ghosts-bake.md
@@ -0,0 +1,5 @@
+---
+'@chainlink/functions-toolkit': patch
+---
+
+Added maximum expiration for DON hosted secrets
diff --git a/src/SecretsManager.ts b/src/SecretsManager.ts
index db7de17..7687b49 100644
--- a/src/SecretsManager.ts
+++ b/src/SecretsManager.ts
@@ -205,8 +205,14 @@ export class SecretsManager {
       throw Error('slotId must be a integer of at least 0')
     }
 
-    if (!Number.isInteger(minutesUntilExpiration) || minutesUntilExpiration < 5) {
-      throw Error('minutesUntilExpiration must be an integer of at least 5')
+    if (
+      !Number.isInteger(minutesUntilExpiration) ||
+      minutesUntilExpiration < 5 ||
+      minutesUntilExpiration > 2880
+    ) {
+      throw Error(
+        'minutesUntilExpiration must be an integer of at least 5 and less than 2880 (48 hours)',
+      )
     }
 
     const encryptedSecretsBase64 = Buffer.from(encryptedSecretsHexstring.slice(2), 'hex').toString(