The "nebula-mgmt" Web UI host-creation path ignores both the server-wide "enrollment_token_ttl" security setting and per-network "network_config.enrollment_token_ttl" overrides. API host creation and token-regeneration paths use the configured TTL resolver, but "POST /ui/hosts" hardcodes "now.Add(24 * time.Hour)" for newly minted agent enrollment tokens. In deployments that intentionally reduce enrollment-token lifetime, any authenticated operator who can create a host through the Web UI can still mint a bearer enrollment token valid for about 24 hours.