diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 7906089..9a01871 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+## v0.15.1
+
+This point release fixes a bug introduced in 0.15.
+
+* Fixed datetime handling in test-repository (#512): This
+  is fallout from python-tuf upgrade in 0.15.0 and resulted in
+  unexpected test-repository action failure
+
 ## v0.15.0
 
 * Fixed repository status page HTML rendering (#430)
diff --git a/repo/tuf_on_ci/_version.py b/repo/tuf_on_ci/_version.py
index 9da2f8f..903e77c 100644
--- a/repo/tuf_on_ci/_version.py
+++ b/repo/tuf_on_ci/_version.py
@@ -1 +1 @@
-__version__ = "0.15.0"
+__version__ = "0.15.1"
diff --git a/repo/tuf_on_ci/client.py b/repo/tuf_on_ci/client.py
index 6830510..17fa9f6 100755
--- a/repo/tuf_on_ci/client.py
+++ b/repo/tuf_on_ci/client.py
@@ -7,7 +7,7 @@
 import os
 import shutil
 import sys
-from datetime import datetime
+from datetime import UTC, datetime
 from filecmp import cmp
 from tempfile import TemporaryDirectory
 from urllib import request
@@ -19,7 +19,7 @@
 
 
 def expiry_check(dir: str, role: str, timestamp: int):
-    ref_time = datetime.fromtimestamp(timestamp)
+    ref_time = datetime.fromtimestamp(timestamp, UTC)
     md = Metadata.from_file(os.path.join(dir, f"{role}.json"))
     expiry = md.signed.expires
     if ref_time > expiry:
@@ -94,7 +94,7 @@ def client(
         if time is not None:
             # HACK: replace reference time with ours: initial root has been loaded
             # already but that is fine: the expiry check only happens during refresh
-            ref_time = datetime.fromtimestamp(time)
+            ref_time = datetime.fromtimestamp(time, UTC)
             updater._trusted_set.reference_time = ref_time
             ref_time_string = f" at reference time {ref_time}"
 
diff --git a/signer/tuf_on_ci_sign/__init__.py b/signer/tuf_on_ci_sign/__init__.py
index 1e0455b..7ccb2fe 100644
--- a/signer/tuf_on_ci_sign/__init__.py
+++ b/signer/tuf_on_ci_sign/__init__.py
@@ -2,6 +2,6 @@
 from tuf_on_ci_sign.import_repo import import_repo
 from tuf_on_ci_sign.sign import sign
 
-__version__ = "0.15.0"
+__version__ = "0.15.1"
 
 __all__ = ["delegate", "import_repo", "sign"]