diff --git a/changelog/unreleased/expiration-grappa-entries.md b/changelog/unreleased/expiration-grappa-entries.md
new file mode 100644
index 0000000000..d3c6b902e0
--- /dev/null
+++ b/changelog/unreleased/expiration-grappa-entries.md
@@ -0,0 +1,7 @@
+Enhancement: Expire cached users and groups entries
+
+Entries in the rest user and group drivers do not expire.
+This means that old users/groups that have been deleted are still in cache.
+Now an expiration of `fetch interval + 1` hours has been set.
+
+https://github.com/cs3org/reva/pull/4121
diff --git a/pkg/cbox/group/rest/cache.go b/pkg/cbox/group/rest/cache.go
index 2f2baf429b..a9fb561678 100644
--- a/pkg/cbox/group/rest/cache.go
+++ b/pkg/cbox/group/rest/cache.go
@@ -158,21 +158,22 @@ func (m *manager) fetchCachedGroupDetails(gid *grouppb.GroupId) (*grouppb.Group,
 }
 
 func (m *manager) cacheGroupDetails(g *grouppb.Group) error {
+	expiration := (m.conf.GroupFetchInterval + 1) * 3600
 	encodedGroup, err := json.Marshal(&g)
 	if err != nil {
 		return err
 	}
-	if err = m.setVal(groupPrefix+idPrefix+strings.ToLower(g.Id.OpaqueId), string(encodedGroup), -1); err != nil {
+	if err = m.setVal(groupPrefix+idPrefix+strings.ToLower(g.Id.OpaqueId), string(encodedGroup), expiration); err != nil {
 		return err
 	}
 
 	if g.GidNumber != 0 {
-		if err = m.setVal(groupPrefix+gidPrefix+strconv.FormatInt(g.GidNumber, 10), g.Id.OpaqueId, -1); err != nil {
+		if err = m.setVal(groupPrefix+gidPrefix+strconv.FormatInt(g.GidNumber, 10), g.Id.OpaqueId, expiration); err != nil {
 			return err
 		}
 	}
 	if g.DisplayName != "" {
-		if err = m.setVal(groupPrefix+namePrefix+g.Id.OpaqueId+"_"+strings.ToLower(g.DisplayName), g.Id.OpaqueId, -1); err != nil {
+		if err = m.setVal(groupPrefix+namePrefix+g.Id.OpaqueId+"_"+strings.ToLower(g.DisplayName), g.Id.OpaqueId, expiration); err != nil {
 			return err
 		}
 	}
diff --git a/pkg/cbox/user/rest/cache.go b/pkg/cbox/user/rest/cache.go
index f6958b94de..6b6f12ac64 100644
--- a/pkg/cbox/user/rest/cache.go
+++ b/pkg/cbox/user/rest/cache.go
@@ -150,26 +150,27 @@ func (m *manager) fetchCachedUserDetails(uid *userpb.UserId) (*userpb.User, erro
 }
 
 func (m *manager) cacheUserDetails(u *userpb.User) error {
+	expiration := (m.conf.UserFetchInterval + 1) * 3600
 	encodedUser, err := json.Marshal(&u)
 	if err != nil {
 		return err
 	}
-	if err = m.setVal(userPrefix+usernamePrefix+strings.ToLower(u.Id.OpaqueId), string(encodedUser), -1); err != nil {
+	if err = m.setVal(userPrefix+usernamePrefix+strings.ToLower(u.Id.OpaqueId), string(encodedUser), expiration); err != nil {
 		return err
 	}
 
 	if u.Mail != "" {
-		if err = m.setVal(userPrefix+mailPrefix+strings.ToLower(u.Mail), string(encodedUser), -1); err != nil {
+		if err = m.setVal(userPrefix+mailPrefix+strings.ToLower(u.Mail), string(encodedUser), expiration); err != nil {
 			return err
 		}
 	}
 	if u.DisplayName != "" {
-		if err = m.setVal(userPrefix+namePrefix+u.Id.OpaqueId+"_"+strings.ReplaceAll(strings.ToLower(u.DisplayName), " ", "_"), string(encodedUser), -1); err != nil {
+		if err = m.setVal(userPrefix+namePrefix+u.Id.OpaqueId+"_"+strings.ReplaceAll(strings.ToLower(u.DisplayName), " ", "_"), string(encodedUser), expiration); err != nil {
 			return err
 		}
 	}
 	if u.UidNumber != 0 {
-		if err = m.setVal(userPrefix+uidPrefix+strconv.FormatInt(u.UidNumber, 10), string(encodedUser), -1); err != nil {
+		if err = m.setVal(userPrefix+uidPrefix+strconv.FormatInt(u.UidNumber, 10), string(encodedUser), expiration); err != nil {
 			return err
 		}
 	}