diff --git a/gateway/pyproject.toml b/gateway/pyproject.toml
index d7e7e73..7c96632 100644
--- a/gateway/pyproject.toml
+++ b/gateway/pyproject.toml
@@ -33,6 +33,28 @@ where = ["src"]
 line-length = 100
 src = ["src"]
 
+# Selected explicitly, because the default set is not a constant.
+#
+# With no `select` here, ruff lints with whatever its installed version
+# defaults to — 413 rules under 0.16.3. `dev` pins only `ruff>=0.6`, and CI
+# installs that extra fresh on every run, so the gate's scope was a function of
+# when pip last resolved rather than of this code. Two findings appeared here
+# the first time a converged environment ran the gate, in a file nobody had
+# touched (T-47).
+#
+# That is the failure this repo keeps meeting from the other side: a check
+# whose result depends on something other than the thing it checks. Pinning the
+# ruff version would freeze the symptom; naming the rules fixes it, and makes
+# a future ruff release a decision rather than a surprise.
+#
+# ASYNC is here on purpose — this is a websocket gateway, and it is the one
+# family whose findings would be genuine bugs rather than style.
+# BLE (blind except) is deliberately absent: main.py catches bare Exception
+# when a device disappears mid-send, which is correct there and would need a
+# noqa on every occurrence to say so.
+[tool.ruff.lint]
+select = ["E", "W", "F", "I", "UP", "B", "ASYNC", "SIM", "C4"]
+
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
 testpaths = ["tests"]
diff --git a/gateway/src/desklock_gateway/main.py b/gateway/src/desklock_gateway/main.py
index 66bbf0c..3273924 100644
--- a/gateway/src/desklock_gateway/main.py
+++ b/gateway/src/desklock_gateway/main.py
@@ -7,7 +7,7 @@ Protocol (see docs/architecture.md — keep in sync):
 
 import asyncio
 import logging
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 
 from fastapi import FastAPI, WebSocket, WebSocketDisconnect
 
@@ -41,7 +41,7 @@ async def _ensure_filler() -> bytes | None:
 
 
 def _now() -> str:
-    return datetime.now(timezone.utc).astimezone().isoformat(timespec="seconds")
+    return datetime.now(UTC).astimezone().isoformat(timespec="seconds")
 
 
 @app.get("/healthz")