diff --git a/api/lifetime_watcher.go b/api/lifetime_watcher.go
index bcb46cf34a44b..b1d81332f1985 100644
--- a/api/lifetime_watcher.go
+++ b/api/lifetime_watcher.go
@@ -377,7 +377,7 @@ func (r *LifetimeWatcher) doRenewWithOptions(tokenMode bool, nonRenewable bool,
 // assumptions given the total lease time; it also adds some jitter to not have
 // clients be in sync.
 func (r *LifetimeWatcher) calculateGrace(leaseDuration time.Duration) {
-	if leaseDuration == 0 {
+	if leaseDuration <= 0 {
 		r.grace = 0
 		return
 	}
diff --git a/api/renewer_test.go b/api/renewer_test.go
index eb28981a48eee..6289b2fd56ac7 100644
--- a/api/renewer_test.go
+++ b/api/renewer_test.go
@@ -149,6 +149,17 @@ func TestLifetimeWatcher(t *testing.T) {
 			nil,
 			false,
 		},
+		{
+			15 * time.Second,
+			"negative_lease_duration",
+			-15,
+			15,
+			func(_ string, _ int) (*Secret, error) {
+				return renewedSecret, nil
+			},
+			nil,
+			true,
+		},
 	}
 
 	for _, tc := range cases {
diff --git a/changelog/12372.txt b/changelog/12372.txt
new file mode 100644
index 0000000000000..22a64c921b350
--- /dev/null
+++ b/changelog/12372.txt
@@ -0,0 +1,3 @@
+```release-note: bug
+core/api: Fix an arm64 bug converting a negative int to an unsigned int
+```
\ No newline at end of file