diff --git a/auth.proto b/auth.proto
index d0acc93..a369b1c 100644
--- a/auth.proto
+++ b/auth.proto
@@ -16,10 +16,12 @@ message Auth {
 
   // Minutes since the project epoch (2024-01-01 UTC), used as a
   // replay-prevention nonce. The Node accepts the message only if
-  // this value is within one minute of its own clock.
-  uint32 timestamp = 2;
+  // this value is within one minute of its own clock. Unit is
+  // encoded in the field name to distinguish from ms/Unix-epoch
+  // timestamps elsewhere in the protocol.
+  uint32 timestamp_min = 2;
 
-  // Truncated HMAC-SHA256 (12 bytes) over (client_id || timestamp),
+  // Truncated HMAC-SHA256 (12 bytes) over (client_id || timestamp_min),
   // computed with the pre-shared key issued to this client. Proves
   // possession of the PSK without revealing it.
   bytes hmac = 3;
diff --git a/ping.proto b/ping.proto
index 421566a..c65ffaa 100644
--- a/ping.proto
+++ b/ping.proto
@@ -11,9 +11,9 @@ package proto;
 message Ping {
   // Client clock at the moment the Ping was prepared, in
   // milliseconds since the Unix epoch. The Node echoes it back in
-  // Pong.timestamp so that the client can compute round-trip time
+  // Pong.timestamp_ms so that the client can compute round-trip time
   // without keeping per-request state.
-  uint64 timestamp = 1;
+  uint64 timestamp_ms = 1;
 
   // Per-peer probe-failure counters accumulated since the previous
   // Ping. The key is the peer Node's IPv4 address in dotted form
diff --git a/pong.proto b/pong.proto
index 680aef3..7bcb8f5 100644
--- a/pong.proto
+++ b/pong.proto
@@ -95,8 +95,8 @@ message Peer {
 // properties, fleet) so the client UI can stay current without a
 // separate channel.
 message Pong {
-  // Echo of Ping.timestamp, used by the client to compute RTT.
-  uint64 timestamp = 1;
+  // Echo of Ping.timestamp_ms, used by the client to compute RTT.
+  uint64 timestamp_ms = 1;
 
   // Current lease snapshot for this client. Always present; an
   // empty Lease means free tier.