diff --git a/src/pkgmgr/actions/code_scanning/__init__.py b/src/pkgmgr/actions/code_scanning/__init__.py
index ed24c1c..c3e0899 100644
--- a/src/pkgmgr/actions/code_scanning/__init__.py
+++ b/src/pkgmgr/actions/code_scanning/__init__.py
@@ -14,8 +14,8 @@ import shutil
 import subprocess
 from collections import Counter
 from dataclasses import dataclass, field
-from datetime import datetime
-from typing import Any, List, Optional
+from datetime import datetime, timezone
+from typing import Any
 
 
 class CodeScanningError(RuntimeError):
@@ -123,18 +123,18 @@ def download_code_scanning(
     repo_name = repo.rstrip("/").split("/")[-1]
 
     if output_dir is None:
-        timestamp = datetime.now().strftime("%Y%m%d%H%M%S")
+        timestamp = datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S")
         output_dir = os.path.join("/tmp", repo_name, "code-scanner", timestamp)
     output_dir = os.path.abspath(os.path.expanduser(output_dir))
     os.makedirs(output_dir, exist_ok=True)
-    generated_at = datetime.now().isoformat(timespec="seconds")
+    generated_at = datetime.now(timezone.utc).isoformat(timespec="seconds")
 
     alerts = _fetch_json(
         f"repos/{repo}/code-scanning/alerts",
         params=[f"state={state}"] if state else None,
     )
 
-    files: List[str] = []
+    files: list[str] = []
 
     def _write(name: str, content: str) -> None:
         path = os.path.join(output_dir, name)
diff --git a/src/pkgmgr/actions/release/files/changelog_md.py b/src/pkgmgr/actions/release/files/changelog_md.py
index 324fc2f..142f9d8 100644
--- a/src/pkgmgr/actions/release/files/changelog_md.py
+++ b/src/pkgmgr/actions/release/files/changelog_md.py
@@ -63,7 +63,7 @@ def update_changelog(
     missing) and above any existing release entries, so the result stays
     markdown-lint-clean (MD041 first-line-h1, MD012 no-multiple-blanks).
     """
-    today = date.today().isoformat()
+    today = date.today().isoformat()  # noqa: DTZ011 - changelog dates are local calendar dates
 
     def _entry_for(raw: str) -> tuple[str, str]:
         body = transform_changelog_message(raw).strip() or f"Release {new_version}"