Nist guidelines used to recommend rotation, and our security team would quickly point to it when people complained.

So of course we jumped on that and security team said "well nist are just guidelines and we go for more stringent requirements"...