diff --git a/backend/tests/api/routes/test_flows.py b/backend/tests/api/routes/test_flows.py
index b2cb0d7..692a3a2 100644
--- a/backend/tests/api/routes/test_flows.py
+++ b/backend/tests/api/routes/test_flows.py
@@ -62,6 +62,11 @@ def test_save_then_read_flow(
     assert body["definition"]["title"] == "Demo"
     assert {node["id"] for node in body["definition"]["nodes"]} == {"sensor", "logger"}
 
+    # The time beside a version carries its offset, so no client guesses a zone.
+    listed = client.get(f"{PREFIX}/", headers=superuser_token_headers).json()["data"]
+    summary = next(flow for flow in listed if flow["name"] == "demo")
+    assert datetime.fromisoformat(summary["updated_at"]).tzinfo is not None
+
 
 def test_name_mismatch_is_rejected(
     client: TestClient, superuser_token_headers: dict[str, str]
diff --git a/docs/code/api.md b/docs/code/api.md
index 84f42cd..2e002ad 100644
--- a/docs/code/api.md
+++ b/docs/code/api.md
@@ -12,7 +12,8 @@ export FLUKSIO=http://127.0.0.1:8000/api/v1
 Use the port printed by `fluksio serve`. For Docker, use
 `http://api.localhost/api/v1`, `http://<host-ip>:8080/api/v1` on a LAN stack,
 or `https://api.<your-domain>/api/v1` for a deployment.
-All paths below are relative to this base.
+All paths below are relative to this base. Timestamps in responses are
+ISO 8601 and always carry their UTC offset.
 
 ## Authenticating