diff --git a/src/ip_ban.c b/src/ip_ban.c
index 1faa8ff..90acc65 100644
--- a/src/ip_ban.c
+++ b/src/ip_ban.c
@@ -196,18 +196,22 @@ void ip_ban_cleanup(void) {
         int window_expired = (entry->first_failure == 0 || (now - entry->first_failure) > window_sec * 10);
 
         if (ban_expired && window_expired && entry->failure_count == 0) {
-            // Preserve ban_count for exponential backoff — only clear transient state.
-            // An IP that was banned before should still get a longer ban if it returns.
-            // Only fully clear the entry if it has never been banned (ban_count == 0).
-            if (entry->ban_count == 0) {
+            // Retain ban_count for 24 hours after the last ban expired.
+            // This ensures exponential backoff persists if the IP returns within 24 hours.
+            // After 24 hours of inactivity, fully clean the entry.
+            int retain_sec = 86400; // 24 hours
+            int last_ban_expired_long_ago = (entry->banned_until == 0 ||
+                                             (now - entry->banned_until) > retain_sec);
+
+            if (last_ban_expired_long_ago) {
+                // Fully clean — IP has been gone for 24+ hours, start fresh if it returns
                 memset(entry, 0, sizeof(ip_ban_entry_t));
                 cleaned++;
             } else {
-                // Keep the entry but reset transient fields — preserve ban_count
+                // Keep entry alive but reset transient fields — preserve ban_count
                 entry->failure_count = 0;
                 entry->first_failure = 0;
-                entry->banned_until = 0;
-                // ban_count preserved intentionally
+                // banned_until and ban_count preserved intentionally
             }
         }
     }
diff --git a/src/main.h b/src/main.h
index 3b1accf..79c5642 100644
--- a/src/main.h
+++ b/src/main.h
@@ -13,8 +13,8 @@
 // Using CRELAY_ prefix to avoid conflicts with nostr_core_lib VERSION macros
 #define CRELAY_VERSION_MAJOR 1
 #define CRELAY_VERSION_MINOR 2
-#define CRELAY_VERSION_PATCH 22
-#define CRELAY_VERSION "v1.2.22"
+#define CRELAY_VERSION_PATCH 23
+#define CRELAY_VERSION "v1.2.23"
 
 // Relay metadata (authoritative source for NIP-11 information)
 #define RELAY_NAME "C-Relay"