diff --git a/modules/mesh-grants/go.mod b/modules/mesh-grants/go.mod
index 17483ea..5676e43 100644
--- a/modules/mesh-grants/go.mod
+++ b/modules/mesh-grants/go.mod
@@ -3,7 +3,7 @@ module mesh-grants
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029205252-7000bd5049ec
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029211750-2e5cc4f16635
 	github.com/nats-io/nats.go v1.54.0
 )
 
diff --git a/modules/mesh-grants/go.sum b/modules/mesh-grants/go.sum
index 6dce500..fe45f51 100644
--- a/modules/mesh-grants/go.sum
+++ b/modules/mesh-grants/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029205252-7000bd5049ec h1:OLXHSQkAHnf03hzJTxRrUsl7vMfMhOx43M5yJpi5L5Y=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029205252-7000bd5049ec/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029211750-2e5cc4f16635 h1:ImOyj4WqH9lwxOr95aH9Wq2iJkUwdtnEyPrASm9TrYA=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029211750-2e5cc4f16635/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-grants/grants_test.go b/modules/mesh-grants/grants_test.go
index c6d9ec7..891abee 100644
--- a/modules/mesh-grants/grants_test.go
+++ b/modules/mesh-grants/grants_test.go
@@ -54,6 +54,7 @@ type fakeBus struct {
 	hold chan struct{}
 	// creates are the streams the part asked to create, refused when refuseCreate.
 	creates      []string
+	createdAge   map[string]time.Duration
 	refuseCreate bool
 	// refuseUsers refuses the bus module's nats_users: the loaded list cannot be read.
 	refuseUsers bool
@@ -133,6 +134,10 @@ func (b *fakeBus) CreateDeclared(cfg jetstream.StreamConfig) error {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 	b.creates = append(b.creates, cfg.Name)
+	if b.createdAge == nil {
+		b.createdAge = map[string]time.Duration{}
+	}
+	b.createdAge[cfg.Name] = cfg.MaxAge
 	if b.refuseCreate {
 		return errors.New("Permissions Violation for Publish to $JS.API.STREAM.CREATE." + cfg.Name)
 	}
@@ -315,7 +320,7 @@ func (b *fakeBus) assign(node, module string) {
 const (
 	natsManifest = `{"module":"nats","version":"1","claims":[{"name":"mesh-broker"}],"own-secrets":{"broker":"/var/lib/nats/broker"}}`
 	xManifest    = `{"module":"mod-x","version":"1","own-secrets":{"broker":"/var/lib/x/broker"},"state":[{"name":"kept","history":3}],` +
-		`"streams":[{"name":"things","events":["thing.added"],"max-age-days":2,"max-mib":5}],"logs":[{"name":"history"}]}`
+		`"streams":[{"name":"things","events":["thing.added"],"max-age-days":2,"max-mib":5}],"logs":[{"name":"history","max-age-days":30}]}`
 	yManifest = `{"module":"mod-y","version":"1","own-secrets":{"broker":"/var/lib/y/broker"},"reads":["mod-x.kept"]}`
 )
 
@@ -1078,7 +1083,8 @@ func TestGrants(t *testing.T) {
 		licence, _ := os.ReadFile(filepath.Join("testdata", "claude-licence-manager.json"))
 		n := newFakeBus()
 		// 1952/S5 (ADR 0564 Limits 4): the bus module's tools bundle declares its own account and what it may remove.
-		n.manifestOf("nats", strings.TrimSuffix(natsManifest, "}")+`,"build":{"artifacts":[{"name":"tools","kind":"bundle","language":"go",`+
+		n.manifestOf("nats", strings.Replace(strings.TrimSuffix(natsManifest, "}"), `"broker":"/var/lib/nats/broker"`, `"broker":"/var/lib/nats/broker","broker-nats-tools":"${dir:tools-secret}/broker-nats-tools"`, 1)+
+			`,"resources":[{"id":"tools-secret","type":"directory","path":"/var/lib/mesh/nats-tools","mode":"0711"}],"build":{"artifacts":[{"name":"tools","kind":"bundle","language":"go",`+
 			`"system":"arch","from":"cmd/nats-tools","binary":"nats-tools","loads":["nats-tools"],"bus":{"removes":["DEAD_LETTER_NOTICES.controller","mesh-host_acts"]}}]}}`)
 		n.manifestOf("claude-licence-manager", string(licence))
 		n.assign("novox", "nats")
@@ -1796,6 +1802,9 @@ func TestGrants(t *testing.T) {
 			!strings.HasPrefix(first.Asserted[0], "mod-x at ") || !slices.Contains(b.events, grants.EventAsserted) {
 			t.Fatalf("the first pass created %v, said %v, events %v", b.creates, first.Asserted, b.events)
 		}
+		if b.createdAge["LOG_mod-x_history"] != 30*24*time.Hour { // a log's max-age-days is its stream's MaxAge (mesh-sdk 2e5cc4f)
+			t.Errorf("the log was created with max age %v, want 30 days", b.createdAge["LOG_mod-x_history"])
+		}
 		a := assertion()
 		if !a.Asserted || a.Says != grants.CreatesMissing {
 			t.Errorf("the assertion kept = %+v", a)
diff --git a/modules/mesh-grants/internal/grants/records.go b/modules/mesh-grants/internal/grants/records.go
index 6194d3f..cf2556e 100644
--- a/modules/mesh-grants/internal/grants/records.go
+++ b/modules/mesh-grants/internal/grants/records.go
@@ -233,7 +233,7 @@ func bucketsOf(m catalogue.Manifest) []buscompose.Bucket {
 func logsOf(m catalogue.Manifest) []buscompose.Log {
 	var out []buscompose.Log
 	for _, l := range m.Logs {
-		out = append(out, buscompose.Log{Module: m.Module, Name: l.Name, MaxMiB: l.Cap()})
+		out = append(out, buscompose.Log{Module: m.Module, Name: l.Name, MaxMiB: l.Cap(), MaxAgeDays: l.MaxAgeDays})
 	}
 	return out
 }