Tokens born already expired

Reported: after Tuesday's hypervisor maintenance, mobile clients get 401 token_expired right after /login. The web app works.

• JWT: exp = iat + 300 (5 min), issued by auth-02, validated by the API fleet.
• auth-02:

$ timedatectl
System clock synchronized: yes
$ chronyc tracking
System time     : 312.40 seconds fast of NTP time
Leap status     : Normal

• chrony config: makestep 1 3 (steps only during the first 3 updates after start).
• The web app uses a server-side session cookie and never checks exp.