Instead of running this `unless: :password_not_required?`, shouldn't we run it only when the password is changed?  I realize `unless: :password_not_required?` might coincidentally only be true when the password is changed, but something like 

`before_save :update_password_expires_at, if: :password_changed?`

would be more clear.

Also, since this method is called in a callback, I think you need to make sure that it returns a true value so that callbacks that come after it are allowed to run.  If you were to add another callback after this one and `DEFAULT_PASSWORD_EXPIRATION_PERIOD` was nil, that other callback wouldn't run.

See "Canceling Callbacks" section of http://api.rubyonrails.org/classes/ActiveRecord/Callbacks.html