diff --git a/cmd/cashier/main.go b/cmd/cashier/main.go
index 768ebcdf25035ada4cf9411f76fe4cba12764d5f..3a341085add12c0ffe88e4bd75ed0d795ca844da 100644
--- a/cmd/cashier/main.go
+++ b/cmd/cashier/main.go
@@ -31,10 +31,12 @@ var (
 )
 
 func installCert(a agent.Agent, cert *ssh.Certificate, key key) error {
+	lifetime := time.Unix(int64(cert.ValidBefore), 0).Sub(time.Now()).Seconds()
 	pubcert := agent.AddedKey{
-		PrivateKey:  key,
-		Certificate: cert,
-		Comment:     cert.KeyId,
+		PrivateKey:   key,
+		Certificate:  cert,
+		Comment:      cert.KeyId,
+		LifetimeSecs: uint32(lifetime),
 	}
 	if err := a.Add(pubcert); err != nil {
 		return fmt.Errorf("error importing certificate: %s", err)
diff --git a/vendor/golang.org/x/crypto/ssh/agent/client.go b/vendor/golang.org/x/crypto/ssh/agent/client.go
index 11d30945a10fb5bcb679b9986c9a1d2fa1c2b112..6d1dca5ef7f6df0208141568e4c7edae00bf120a 100644
--- a/vendor/golang.org/x/crypto/ssh/agent/client.go
+++ b/vendor/golang.org/x/crypto/ssh/agent/client.go
@@ -580,25 +580,28 @@ func (c *client) insertCert(s interface{}, cert *ssh.Certificate, comment string
 		})
 	case *dsa.PrivateKey:
 		req = ssh.Marshal(dsaCertMsg{
-			Type:      cert.Type(),
-			CertBytes: cert.Marshal(),
-			X:         k.X,
-			Comments:  comment,
+			Type:        cert.Type(),
+			CertBytes:   cert.Marshal(),
+			X:           k.X,
+			Comments:    comment,
+			Constraints: constraints,
 		})
 	case *ecdsa.PrivateKey:
 		req = ssh.Marshal(ecdsaCertMsg{
-			Type:      cert.Type(),
-			CertBytes: cert.Marshal(),
-			D:         k.D,
-			Comments:  comment,
+			Type:        cert.Type(),
+			CertBytes:   cert.Marshal(),
+			D:           k.D,
+			Comments:    comment,
+			Constraints: constraints,
 		})
 	case ed25519.PrivateKey:
 		req = ssh.Marshal(ed25519CertMsg{
-			Type:      cert.Type(),
-			CertBytes: cert.Marshal(),
-			Pub:       []byte(k)[32:],
-			Priv:      []byte(k),
-			Comments:  comment,
+			Type:        cert.Type(),
+			CertBytes:   cert.Marshal(),
+			Pub:         []byte(k)[32:],
+			Priv:        []byte(k),
+			Comments:    comment,
+			Constraints: constraints,
 		})
 	default:
 		return fmt.Errorf("agent: unsupported key type %T", s)
diff --git a/vendor/vendor.json b/vendor/vendor.json
index 75f7e78aa9dfb1fe00df724b385b3ac78b90e269..0c5e8c931e856014c2d1d3a8a34914137aae2fe2 100644
--- a/vendor/vendor.json
+++ b/vendor/vendor.json
@@ -368,10 +368,10 @@
 			"revisionTime": "2016-05-16T23:05:56Z"
 		},
 		{
-			"checksumSHA1": "SEz1b89e679TV/nkIHlu49H5wTM=",
+			"checksumSHA1": "EcKMEjHXZnW85PGnmiVGLknf8HU=",
 			"path": "golang.org/x/crypto/ssh/agent",
-			"revision": "5bcd134fee4dd1475da17714aac19c0aa0142e2f",
-			"revisionTime": "2016-05-16T23:05:56Z"
+			"revision": "89d9e62992539701a49a19c52ebb33e84cbbe80f",
+			"revisionTime": "2016-06-03T20:06:38Z"
 		},
 		{
 			"checksumSHA1": "9jjO5GjLa0XF/nfWihF02RoH4qc=",