diff --git a/data/common/common.yaml b/data/common/common.yaml
--- a/data/common/common.yaml
+++ b/data/common/common.yaml
@@ -3231,6 +3231,8 @@
   smtp_server_from: noreply@softwareheritage.org
   smtp_server_from_display_name: Software Heritage Authentication Service
   brute_force_protected: true
+  # set OIDC refresh token expiration to 6 hours
+  sso_session_idle_timeout: 21600
 
 keycloak::resources::clients::common_settings:
   public_client: true