401 Unauthorized on /api/v2/analytics after token refresh with clock skew

The token refresh returns a 200 OK with a new access token, but the subsequent call to /api/v2/analytics/interactions/summary fails with 401 Unauthorized. The Genesys Cloud servers are showing a 2-second clock skew against our New Relic instrumentation server, causing the JWT exp claim to be rejected immediately upon arrival.

POST /api/v2/oauth/token
200 OK -> { "access_token": "eyJhbG...", "expires_in": 3600 }

GET /api/v2/analytics/interactions/summary
401 Unauthorized -> "message": "Invalid token"

Is there a specific leeway parameter for the GC API to handle minor clock drift, or do I need to force a re-auth on every 401?