diff --git a/modules/prometheus/alert-rules.nix b/modules/prometheus/alert-rules.nix
index b2f2a11..1df8a95 100644
--- a/modules/prometheus/alert-rules.nix
+++ b/modules/prometheus/alert-rules.nix
@@ -199,8 +199,8 @@ lib.mapAttrsToList
       };
     */
     cert_expiry = {
-      condition = "(probe_ssl_earliest_cert_expiry - time())/(3600*24) < 30";
-      description = "{{$labels.instance}}: The TLS certificate will expire in less than 30 days: {{$value}}s";
+      condition = "(probe_ssl_earliest_cert_expiry - time())/(3600*24) < 21";
+      description = "{{$labels.instance}}: The TLS certificate will expire in less than 21 days: {{$value}}s";
     };
 
     # ignore devices that disabled S.M.A.R.T (example if attached via USB)
diff --git a/modules/prometheus/default.nix b/modules/prometheus/default.nix
index bdc7891..8b857d6 100644
--- a/modules/prometheus/default.nix
+++ b/modules/prometheus/default.nix
@@ -34,7 +34,6 @@ in
       blackbox = {
         enable = true;
         # Default port is 9115
-        # Listen on 0.0.0.0, bet we only open the firewall for wg0
         openFirewall = false;
 
         configFile = pkgs.writeTextFile {
@@ -71,7 +70,7 @@ in
     scrapeConfigs = [
       {
         job_name = "blackbox";
-        scrape_interval = "2m";
+        scrape_interval = "5m";
         metrics_path = "/probe";
         params = {
           module = [ "http_2xx" ];