diff --git a/mongo/options/autoencryptionoptions.go b/mongo/options/autoencryptionoptions.go
index a09edeabc5..64c7c90817 100644
--- a/mongo/options/autoencryptionoptions.go
+++ b/mongo/options/autoencryptionoptions.go
@@ -168,6 +168,7 @@ func (a *AutoEncryptionOptions) SetBypassQueryAnalysis(bypass bool) *AutoEncrypt
 }
 
 // SetKeyExpiration specifies duration for the key expiration. 0 or negative value means "never expire".
+// The granularity is in milliseconds. Any sub-millisecond fraction will be rounded up.
 func (a *AutoEncryptionOptions) SetKeyExpiration(expiration time.Duration) *AutoEncryptionOptions {
 	a.KeyExpiration = &expiration
 
diff --git a/x/mongo/driver/mongocrypt/mongocrypt.go b/x/mongo/driver/mongocrypt/mongocrypt.go
index 421e14a136..91b950c371 100644
--- a/x/mongo/driver/mongocrypt/mongocrypt.go
+++ b/x/mongo/driver/mongocrypt/mongocrypt.go
@@ -20,6 +20,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"time"
 	"unsafe"
 
 	"go.mongodb.org/mongo-driver/v2/bson"
@@ -91,11 +92,11 @@ func NewMongoCrypt(opts *options.MongoCryptOptions) (*MongoCrypt, error) {
 
 	var keyExpirationMs uint64 = 60_000 // 60,000 ms
 	if opts.KeyExpiration != nil {
-		expirationMs := opts.KeyExpiration.Milliseconds()
-		if expirationMs < 0 {
+		if *opts.KeyExpiration <= 0 {
 			keyExpirationMs = 0
 		} else {
-			keyExpirationMs = uint64(expirationMs)
+			// find the ceiling integer millisecond for the expiration
+			keyExpirationMs = uint64((*opts.KeyExpiration + time.Millisecond - 1) / time.Millisecond)
 		}
 	}
 	C.mongocrypt_setopt_key_expiration(crypt.wrapped, C.uint64_t(keyExpirationMs))
diff --git a/x/mongo/driver/mongocrypt/options/mongocrypt_options.go b/x/mongo/driver/mongocrypt/options/mongocrypt_options.go
index 7a4432af26..504065d4bf 100644
--- a/x/mongo/driver/mongocrypt/options/mongocrypt_options.go
+++ b/x/mongo/driver/mongocrypt/options/mongocrypt_options.go
@@ -74,6 +74,7 @@ func (mo *MongoCryptOptions) SetHTTPClient(httpClient *http.Client) *MongoCryptO
 }
 
 // SetKeyExpiration sets the key expiration duration. 0 means "never expire".
+// The granularity is in milliseconds. Any sub-millisecond fraction will be rounded up.
 func (mo *MongoCryptOptions) SetKeyExpiration(expiration *time.Duration) *MongoCryptOptions {
 	mo.KeyExpiration = expiration
 	return mo