diff --git a/backend/cmd/backend/main.go b/backend/cmd/backend/main.go
index 2d87fb6..8afd02e 100644
--- a/backend/cmd/backend/main.go
+++ b/backend/cmd/backend/main.go
@@ -15,6 +15,13 @@ import (
 	"syscall"
 	"time"
 
+	// The IANA time-zone database, embedded in the binary. The image ships one today, but the
+	// dependency is not one to leave implicit: the taxpayer's zone decides which tax month an
+	// income is filed under, and the config refuses to boot on a zone it cannot resolve rather
+	// than silently falling back to UTC and misfiling. Embedding it makes that correctness
+	// independent of whatever the base image happens to contain.
+	_ "time/tzdata"
+
 	"github.com/google/uuid"
 	"go.uber.org/zap"
 
diff --git a/backend/internal/config/config_test.go b/backend/internal/config/config_test.go
index 90ed415..a8a430e 100644
--- a/backend/internal/config/config_test.go
+++ b/backend/internal/config/config_test.go
@@ -202,3 +202,50 @@ func TestLoadGuestReaperDefaultsAndOverride(t *testing.T) {
 		t.Fatal("Load: expected an error for a non-positive reap interval, got nil")
 	}
 }
+
+// TestLoadMyNalogTimeZone pins the taxpayer's time zone: it defaults to Europe/Moscow and an
+// unresolvable zone is a hard boot failure, never a quiet fall back to UTC.
+//
+// The offset a receipt carries decides which tax month an income is filed under, so a silent UTC
+// default would misfile every near-midnight payment at a month boundary. That is also why the
+// backend embeds the IANA database (a blank time/tzdata import in cmd/backend) instead of trusting
+// the base image to ship one.
+func TestLoadMyNalogTimeZone(t *testing.T) {
+	base := func(t *testing.T) {
+		t.Helper()
+		t.Setenv("BACKEND_POSTGRES_DSN", testDSN)
+		t.Setenv("BACKEND_DICT_DIR", "/dict")
+	}
+
+	t.Run("defaults to the taxpayer's zone", func(t *testing.T) {
+		base(t)
+		t.Setenv("BACKEND_MYNALOG_TZ", "")
+		c, err := Load()
+		if err != nil {
+			t.Fatalf("load: %v", err)
+		}
+		if got := c.MyNalog.Location.String(); got != "Europe/Moscow" {
+			t.Fatalf("time zone = %q, want Europe/Moscow", got)
+		}
+	})
+
+	t.Run("honours an explicit zone", func(t *testing.T) {
+		base(t)
+		t.Setenv("BACKEND_MYNALOG_TZ", "Asia/Yekaterinburg")
+		c, err := Load()
+		if err != nil {
+			t.Fatalf("load: %v", err)
+		}
+		if got := c.MyNalog.Location.String(); got != "Asia/Yekaterinburg" {
+			t.Fatalf("time zone = %q", got)
+		}
+	})
+
+	t.Run("refuses an unresolvable zone", func(t *testing.T) {
+		base(t)
+		t.Setenv("BACKEND_MYNALOG_TZ", "Mars/Olympus_Mons")
+		if _, err := Load(); err == nil {
+			t.Fatal("an unknown time zone must fail the boot, not fall back to UTC")
+		}
+	})
+}