Invalidating render cache items for anonymous?
the max-age (maximum age) ... defaults to &quot;permanently (forever) cacheable&quot;
...
Cache contexts, tags and max-age must always be set, because they affect the cacheability of the entire response. Therefore they &quot;bubble&quot;: parents automatically receive them.
Cache keys must only be set if the render array should be cached.

from https://www.drupal.org/docs/8/api/render-api/cacheability-of-render-arrays
Render arrays are cached indefinitely by default and setting the page cache expiration time doesn't change the cacheability metadata of render arrays in general. As on the linked page above, ideally you do something like:
// Merges the cache contexts, cache tags and max-age of the config object 
// and user entity that the render array depend on.
$renderer-&gt;addCacheableDependency($build, $config);
$renderer-&gt;addCacheableDependency($build, \Drupal\user\Entity\User::load($current_user-&gt;id())); 

But this doesn't work here because the data lives outside of Drupal - or more specifically, if you add anything that doesn't implement Drupal\Core\Cache\CacheableDependencyInterface as a dependency, the render array is marked as non-cacheable and it bubbles up: see Drupal\Core\Cache\RefinableCacheableDependencyTrait::addCacheableDependency().
So in this case I think you just have to set the max-age yourself.