diff --git a/server/crates/arbiter-server/src/actors/proposal_manager.rs b/server/crates/arbiter-server/src/actors/proposal_manager.rs
index 7945bf1..08a8694 100644
--- a/server/crates/arbiter-server/src/actors/proposal_manager.rs
+++ b/server/crates/arbiter-server/src/actors/proposal_manager.rs
@@ -6,6 +6,7 @@ use crate::{
     },
     db::{
         self,
+        functions::unixepoch,
         models::{
             NewProposal, NewProposalVote, NewRecoveryProposalVote, NewRecoveryWakeupRequest,
             OperatorIdentityId, Proposal, ProposalId, ProposalStatus, RecoveryOperatorIdentityId,
@@ -570,15 +571,13 @@ impl ProposalManager {
 
     /// Returns true when an uncancelled wakeup request has passed the 14-day dispute window.
     async fn is_recovery_active_conn(conn: &mut db::DatabaseConnection) -> Result<bool, Error> {
-        let cutoff = diesel::dsl::sql::<diesel::sql_types::Integer>(&format!(
-            "unixepoch('now') - {}",
-            Self::WAKEUP_DELAY_SECS
-        ));
-
         select(exists(
             schema::recovery_wakeup_request::table
                 .filter(schema::recovery_wakeup_request::cancelled_at.is_null())
-                .filter(schema::recovery_wakeup_request::requested_at.le(cutoff)),
+                .filter(
+                    schema::recovery_wakeup_request::requested_at
+                        .le(unixepoch("now") - Self::WAKEUP_DELAY_SECS),
+                ),
         ))
         .get_result(conn)
         .await
diff --git a/server/crates/arbiter-server/src/db/functions.rs b/server/crates/arbiter-server/src/db/functions.rs
new file mode 100644
index 0000000..faf6465
--- /dev/null
+++ b/server/crates/arbiter-server/src/db/functions.rs
@@ -0,0 +1,12 @@
+//! Typed bindings for the SQLite scalar functions used in Diesel expressions.
+
+use diesel::sql_types::{Integer, Text};
+
+diesel::define_sql_function! {
+    /// SQLite `unixepoch(modifier)` -- seconds since the Unix epoch.
+    ///
+    /// Declared so timestamp comparisons are built by the query DSL instead of by
+    /// `format!`-ing a SQL fragment: the argument becomes a bind parameter and the
+    /// result type is checked against the column it is compared with.
+    fn unixepoch(modifier: Text) -> Integer;
+}
diff --git a/server/crates/arbiter-server/src/db/mod.rs b/server/crates/arbiter-server/src/db/mod.rs
index 1ade36f..b20d45f 100644
--- a/server/crates/arbiter-server/src/db/mod.rs
+++ b/server/crates/arbiter-server/src/db/mod.rs
@@ -8,6 +8,7 @@ use diesel_migrations::{EmbeddedMigrations, MigrationHarness, embed_migrations};
 use thiserror::Error;
 use tracing::info;
 
+pub mod functions;
 pub mod models;
 pub mod proposal;
 pub mod schema;