diff --git a/launch_env.sh b/launch_env.sh
index 60d710d43..60b112fa7 100755
--- a/launch_env.sh
+++ b/launch_env.sh
@@ -28,10 +28,11 @@ export STREAM_QUALITY=50
 export STREAM_FPS=10
 
 # --- system time (this hardware has no battery-backed RTC) ---
-# Every boot the clock starts at 1970, which breaks TLS: the model list and downloads fail
-# with "certificate is not yet valid" until NTP or GPS catches up. Seed a recent date so TLS
-# works from the start; NTP/GPS correct it to the second afterwards.
-if [ "$(date +%Y)" -lt 2020 ]; then
+# On a cold boot there is no sane clock: AGNOS restores a stale timestamp (or the epoch),
+# which is still far earlier than the TLS certificate validity and makes the model
+# list/download fail with "certificate is not yet valid". Force a known-recent date so
+# TLS works immediately; NTP/GPS correct it afterwards.
+if [ "$(date +%Y%m%d)" -lt 20261009 ]; then
   sudo date -s "2026-10-09 12:00:00" >/dev/null 2>&1
-  printf 'seeded %s (was < 2020)\n' "$(date -Is)" >> /data/time_seed.log 2>/dev/null
+  printf 'seeded %s (was earlier than 2026-10-09)\n' "$(date -Is)" >> /data/time_seed.log 2>/dev/null
 fi