diff --git a/falco/helm-values.yaml b/falco/helm-values.yaml
index 53de8bb..cebde56 100644
--- a/falco/helm-values.yaml
+++ b/falco/helm-values.yaml
@@ -143,6 +143,7 @@ falcosidekick:
     enabled: true
     replicaCount: 1
     disableauth: true  # Disable basic auth - using Authelia SSO
+    ttl: 21600  # 6 hours - events older than this are auto-deleted
 
     service:
       type: ClusterIP