diff --git a/packages/cultcache-rs/src/lib.rs b/packages/cultcache-rs/src/lib.rs
index b41b9668..0e60a0c2 100644
--- a/packages/cultcache-rs/src/lib.rs
+++ b/packages/cultcache-rs/src/lib.rs
@@ -4320,7 +4320,7 @@ fn restamped_over(entry: &CultCacheEnvelope, held: &[CultCacheEnvelope]) -> Resu
 
 /// Whether `text` is a `stored_at` stamp: the one shape pinned in `tests/vectors/stored-at-stamp/`. An RFC 3339 date-time,
 /// `YYYY-MM-DDThh:mm:ss`, an optional fraction of 1 to 9 digits, then `Z` or `+hh:mm` / `-hh:mm` (hours 00-23, minutes 00-59);
-/// uppercase `T` and `Z`, ASCII digits, no surrounding whitespace, a real calendar date, seconds 00-59, and an instant (the
+/// uppercase `T` and `Z`, ASCII digits, no surrounding whitespace, a real calendar date, seconds 00-59, a local year of 0001-9999, and an instant (the
 /// offset applied) within years 0001-9999. Checked by hand, not by `chrono`'s RFC 3339 reader, which takes other shapes
 /// (lowercase `t`, a space, a leap second). A peer's `storedAt` is stored as it arrives, so one that is not a stamp is refused.
 pub fn is_stored_at_stamp(text: &str) -> bool {
@@ -4360,7 +4360,7 @@ pub fn is_stored_at_stamp(text: &str) -> bool {
     } else {
         return false;
     };
-    if second > 59 {
+    if second > 59 || year < 1 {
         return false;
     }
     let Some(local) = chrono::NaiveDate::from_ymd_opt(year as i32, month, day)