Assigning to brennen to look at for the moment, per IRC:

19:14:51     +thcipriani brennen: would the gitlab-rake gitlab:tokens:edit work to remove an expiry date on an
                         existing token for the maven group?
19:15:01         brennen thcipriani: we can try it

The potentially easier action than database updates that we have been taking with other PATs is issuing a new non-expiring token now that the upstream allows that.

Yeah, probably true.

I did specifically remove the expiry for this one - see T385930#10841299.