diff --git a/docs/design-decisions/022-zulip-prefs-form-design.md b/docs/design-decisions/022-zulip-prefs-form-design.md
index cc91442d..dab050c5 100644
--- a/docs/design-decisions/022-zulip-prefs-form-design.md
+++ b/docs/design-decisions/022-zulip-prefs-form-design.md
@@ -44,14 +44,12 @@ Admission to being a reviewer is unchanged; only authentication moved.
 | Editable field set + validation | `core.forms.ReviewerPreferenceForm` |
 | Formset assembly, ownership scoping, label catalog | `core.services.reviewer_prefs` |
 | Field markup | `templates/shared/_reviewer_prefs_fields.html` |
-| Timezone for local times | `zulip_bot.services.user_timezone` |
+| Timezone for local times | The browser, via `prefs_form.js` and the posted `timezone` field |
 | The page itself | `console.views.prefs` + `templates/console/prefs.html` |
 
 `core.services.reviewer_prefs` reads `syncer.models.LabelDef` at module scope, matching the existing
-`core/admin.py` precedent. Timezone resolution lives in `zulip_bot` because its authoritative source
-is Zulip's own user record and `core/services` otherwise carries no app dependencies; console access
-stays independent of Zulip *reachability* — an unlinked or unreachable Zulip falls through to
-`core.User.timezone`, then the Django default.
+`core/admin.py` precedent. The page needs nothing from Zulip: times are shown and read in the
+browser's zone (see "Times are in the browser's zone" below).
 
 ### Invariants
 
@@ -99,10 +97,30 @@ Nothing about the page expires. The Django session bounds an editing window inst
 `SESSION_SAVE_EVERY_REQUEST = True` slides the two-week `SESSION_COOKIE_AGE` on activity so a long
 edit cannot POST into a lapsed cookie; the `beforeunload` dirty guard is the backstop.
 
+### Times are in the browser's zone
+
+- The server renders every time in its default zone (`TIME_ZONE`), and the form posts back, in a
+  hidden `timezone` field, the zone its times are in. `prefs_form.js` rewrites each `away_until` from
+  the stored instant in its `data-utc` into the browser's zone
+  (`Intl.DateTimeFormat().resolvedOptions().timeZone`), and that field with it. So the server reads a
+  naive `away_until` in exactly the zone it was shown in, whichever that was.
+- The "saved at" time is a `<time datetime>`, localized by `console/base.html` like every other
+  console timestamp. Zulip messages already show times in each reader's zone (`<time:…>` tags), so
+  no reviewer-facing surface picks a zone on the server.
+- A posted zone this server cannot load saves nothing, with a banner saying why, rather than reading
+  the times in some other zone.
+- Without JS the page stays in the server's zone and names it.
+- This replaced a server-side resolver, `zulip_bot.services.user_timezone` (Zulip's zone →
+  `core.User.timezone` → the default). It cost a Zulip API call per render and fell back to UTC for
+  anyone without a Zulip zone. It also rendered the page outside the zone it validated in, so times
+  showed in UTC under the reviewer's zone name, and every save moved `away_until` by that zone's UTC
+  offset (#219).
+
 ### Front-end assets
 
 `console/static/console/prefs_form.{css,js}` are console-owned. The JS is progressive enhancement
-only — an unsaved-changes guard and the per-row "clear away time" buttons — with **no countdown**,
+only — showing times in the browser's zone, an unsaved-changes guard and the per-row "clear away
+time" buttons — with **no countdown**,
 which is what let the expiry helpers stay behind in `zulip_bot/static/zulip_bot/expiry.js` for the
 close-pr / label-pr token pages that still need them. (Those pages import them as a *sibling* module,
 and a relative ES import must resolve both as a served path in the browser and an on-disk path under
@@ -120,8 +138,8 @@ and cover both apps' modules; CI runs them (`.github/workflows/ci.yml`).
   reviewers". Intended (invariant 2), but user-visible.
 - Editing scope widened from a token snapshot to all current rows, which is why ownership filtering
   must be applied on POST as well as GET.
-- `core.User.timezone` is still only ever set by hand in the Django admin, so in practice the
-  timezone comes from Zulip's user record per render, or the project default. See Follow-Ups.
+- `core.User.timezone` is read by nothing since the browser supplies the zone; it was only ever set
+  by hand in the Django admin. See Follow-Ups.
 
 ## Operational Notes
 
@@ -136,20 +154,20 @@ and cover both apps' modules; CI runs them (`.github/workflows/ci.yml`).
   `templates/zulip_bot/prefs_form.html`, `templates/zulip_bot/prefs_invalid.html`, and the token test
   module (its form-behavior coverage moved to `console/tests/test_prefs_form_fields.py`, its
   field-accounting guard to `core/tests/test_reviewer_preference_form.py`, and its timezone-chain
-  coverage to `zulip_bot/tests/test_user_timezone.py`).
+  coverage to `zulip_bot/tests/test_user_timezone.py`, since removed with that chain).
 - **Pre-flight for the retirement:** every `ReviewerPreference` row's user must have a usable
   `github_login` — under GitHub OAuth that, not `zulip_user_id`, is what would lock someone out.
   Registration always sets it (it goes through GitHub OAuth), as does `import_reviewer_topics`.
 - **Tests.** `console/tests/test_prefs.py` (auth, admission gate, no-row-creation, cross-reviewer POST,
-  timezone), `console/tests/test_prefs_form_fields.py` (fields, validation, label catalog),
-  `zulip_bot/tests/test_user_timezone.py`, `core/tests/test_reviewer_preference_form.py`, and the
-  vitest specs above.
+  posted-timezone handling), `console/tests/test_prefs_form_fields.py` (fields, validation, label
+  catalog), `core/tests/test_reviewer_preference_form.py`, and the vitest specs above (which cover
+  the browser's half of the timezone round trip).
 
 ## Follow-Ups
 
-- **Persist a browser-reported timezone.** `core.User.timezone` is admin-only today; storing
-  `Intl.DateTimeFormat().resolvedOptions().timeZone` on first visit would make the fallback real and
-  let us drop the per-render Zulip API round-trip.
+- **Drop `core.User.timezone`.** Nothing reads it now that the page uses the browser's zone (which
+  closed the earlier follow-up, "persist a browser-reported timezone"). Removing the column needs a
+  migration and a `scripts/backup_policy.py` check.
 - Optional confirmation DM after a successful preferences change (stage C3 of the original plan).
 - Structured logging for saves/rejections (stage C1) — never token or form contents.
 
diff --git a/qb_site/console/AGENTS.md b/qb_site/console/AGENTS.md
index 79fcfa67..7b1f55e2 100644
--- a/qb_site/console/AGENTS.md
+++ b/qb_site/console/AGENTS.md
@@ -90,17 +90,24 @@
 - Ownership scoping lives in the shared builder: the queryset is narrowed to the supplied rows *and*
   their owner on GET and POST alike, so a posted `form-<n>-id` naming someone else's row fails
   validation. Never widen that queryset at a call site.
-- Timezone comes from `zulip_bot.services.user_timezone.resolve_user_timezone_name` (Zulip's zone →
-  `core.User.timezone` → Django default) and is what naive `away_until` input means. The page renders
-  no countdown: the session bounds it, and `SESSION_SAVE_EVERY_REQUEST` slides that window.
+- Times are in the browser's zone (design doc 022). The server renders them in its default zone and
+  the form posts back, in the hidden `timezone` field, the zone they are in; `prefs_form.js` rewrites
+  each `away_until` (from the stored instant in its `data-utc`) and that field into the browser's
+  zone. A POST's naive `away_until` is read in the posted zone, so it is always the zone it was shown
+  in. A posted zone the server cannot load (`_zone_or_none`) saves nothing rather than misreading the
+  times. Rendering stays inside `timezone.override`: the `date` filter and the widget convert at
+  render time. There is no Zulip lookup.
+- The page renders no countdown: the session bounds it, and `SESSION_SAVE_EVERY_REQUEST` slides that
+  window.
 - Styling/JS: `templates/console/prefs.html` extends `console/base.html` and uses its `extra_css` /
   `extra_js` blocks to load `console/prefs_form.css|js`, both console-owned. The JS is progressive
-  enhancement only (unsaved-changes guard, "clear away time" buttons, and the excluded-labels picker:
-  a filterable checkbox list over the label catalog the template emits with `json_script`, writing
-  one label per line into the hidden textarea that is still the submitted field; design doc 057)
-  with **no countdown** — the session bounds this page, not a link TTL — which is why the expiry
-  helpers stayed behind in `zulip_bot/static/zulip_bot/expiry.js` for the close-pr / label-pr token
-  pages. Its vitest spec lives with those, in `qb_site/zulip_bot/frontend/tests/`.
+  enhancement only (times in the browser's zone, unsaved-changes guard, "clear away time" buttons,
+  and the excluded-labels picker: a filterable checkbox list over the label catalog the template
+  emits with `json_script`, writing one label per line into the hidden textarea that is still the
+  submitted field; design doc 057) with **no countdown** — the session bounds this page, not a link
+  TTL — which is why the expiry helpers stayed behind in `zulip_bot/static/zulip_bot/expiry.js` for
+  the close-pr / label-pr token pages. Its vitest spec lives with those, in
+  `qb_site/zulip_bot/frontend/tests/`.
 
 ## Accept / decline / assign-anyway / unassign (the load-bearing handlers)
 - All `POST`. Accept and decline re-validate live state via the single
@@ -169,9 +176,8 @@
 - This app is step `[12/13]` of `scripts/repo_check_compose.sh`. It was missing from that script until
   the prefs work added it, so console tests had never run in CI — if you add an app, add its step.
 - View tests mock `console.views.GitHubOAuthClient`, `console.views.assign_reviewer_and_record`,
-  `console.views.GitHubAssignmentClient` (unassign), `console.views._enqueue_pr_sync`, and
-  `console.views.resolve_user_timezone_name` (prefs), and seed the session directly; no real GitHub
-  or Zulip calls. `tests/test_prefs.py` pins the prefs invariants (no row creation, admission gate at
-  sign-in *and* per view, cross-reviewer POST rejection, timezone interpretation) and
-  `tests/test_prefs_form_fields.py` covers fields, validation and the label catalog. Canonical full run
-  stays `bash scripts/repo_check_compose.sh`.
+  `console.views.GitHubAssignmentClient` (unassign) and `console.views._enqueue_pr_sync`, and seed
+  the session directly; no real GitHub or Zulip calls. `tests/test_prefs.py` pins the prefs invariants
+  (no row creation, admission gate at sign-in *and* per view, cross-reviewer POST rejection, reading
+  times in the posted zone) and `tests/test_prefs_form_fields.py` covers fields, validation and the
+  label catalog. Canonical full run stays `bash scripts/repo_check_compose.sh`.
diff --git a/qb_site/console/static/console/prefs_form.js b/qb_site/console/static/console/prefs_form.js
index b901e7b4..fa257c86 100644
--- a/qb_site/console/static/console/prefs_form.js
+++ b/qb_site/console/static/console/prefs_form.js
@@ -1,7 +1,7 @@
 // Reviewer preferences form behavior for /console/preferences/ (design doc 022).
 //
-// Progressive enhancement only: an unsaved-changes guard, the per-row "clear away time" buttons and
-// the excluded-labels picker. There is deliberately no countdown — the console session bounds this
+// Progressive enhancement only: showing times in the browser's zone, an unsaved-changes guard, the
+// per-row "clear away time" buttons and the excluded-labels picker. There is deliberately no countdown — the console session bounds this
 // page, not a link TTL — which is why the expiry helpers stayed behind in
 // `zulip_bot/static/zulip_bot/expiry.js` with the close-pr / label-pr token pages.
 
@@ -11,6 +11,64 @@ function serializeForm(form) {
 
 const fold = (name) => name.toLowerCase();
 
+// The browser's IANA zone, or "" when it will not say.
+function browserTimeZone() {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().timeZone || "";
+  } catch {
+    return "";
+  }
+}
+
+// `date` as a `datetime-local` value ("YYYY-MM-DDTHH:MM") on the wall clock of `timeZone`.
+export function toDatetimeLocalValue(date, timeZone) {
+  const format = new Intl.DateTimeFormat("en-US", {
+    timeZone,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    hourCycle: "h23", // midnight is 00, never 24
+  });
+  const parts = {};
+  for (const { type, value } of format.formatToParts(date)) {
+    parts[type] = value;
+  }
+  return `${parts.year}-${parts.month}-${parts.day}T${parts.hour}:${parts.minute}`;
+}
+
+// The page's times are in the zone its `timezone` field names: the server's default, as rendered.
+// Rewrite each `away_until` from the stored instant in its `data-utc` into the browser's zone, and
+// post that zone back, so the server reads the times in the zone they were shown in (design doc
+// 022). A page already in the browser's zone (a re-render after a failed save) keeps what was typed.
+// All or nothing: if any time cannot be converted, the page stays in the server's zone, which still
+// agrees with every time on it.
+export function localizeTimes(root = document, browserZone = browserTimeZone()) {
+  const field = root.getElementById("prefs-timezone");
+  if (!(field instanceof HTMLInputElement) || !browserZone) {
+    return;
+  }
+  if (field.value !== browserZone) {
+    let rewrites;
+    try {
+      rewrites = [...root.querySelectorAll("input[data-utc]")].map((input) => [
+        input,
+        toDatetimeLocalValue(new Date(input.dataset.utc), browserZone),
+      ]);
+    } catch {
+      return;
+    }
+    for (const [input, value] of rewrites) {
+      input.value = value;
+    }
+    field.value = browserZone;
+  }
+  for (const name of root.querySelectorAll(".js-timezone-name")) {
+    name.textContent = browserZone;
+  }
+}
+
 // Excluded-labels picker (design doc 057): a filter box over a short scrolling list of checkboxes,
 // one per repository label (the JSON block the template renders), plus a removable chip per chosen
 // label. Real checkboxes rather than a pop-up suggestion list: the browsers' own <datalist> shows
@@ -215,7 +273,7 @@ export function mountLabelPicker(container, root = document) {
   };
 }
 
-export function mountPrefsForm(root = document) {
+export function mountPrefsForm(root = document, browserZone = browserTimeZone()) {
   const container = root.getElementById("prefs-root");
   if (!container) {
     return () => undefined;
@@ -226,7 +284,9 @@ export function mountPrefsForm(root = document) {
     return () => undefined;
   }
 
-  // Before the snapshot below. Mounting never rewrites the textarea, so the page starts clean.
+  // Both before the snapshot below, so neither counts as an unsaved change. Mounting never rewrites
+  // the textarea, so the page starts clean.
+  localizeTimes(root, browserZone);
   const unmountPickers = [...root.querySelectorAll(".js-label-picker")].map((picker) => mountLabelPicker(picker, root));
 
   let dirty = false;
diff --git a/qb_site/console/tests/test_prefs.py b/qb_site/console/tests/test_prefs.py
index 45383e3b..00afeb40 100644
--- a/qb_site/console/tests/test_prefs.py
+++ b/qb_site/console/tests/test_prefs.py
@@ -7,10 +7,11 @@
 
 from __future__ import annotations
 
+import re
 from datetime import datetime, timedelta, timezone as dt_timezone
 from unittest.mock import MagicMock, patch
 
-from django.test import TestCase
+from django.test import TestCase, override_settings
 from django.urls import reverse
 from django.utils import timezone
 
@@ -234,27 +235,100 @@ def test_cannot_post_another_reviewers_row(self) -> None:
         self.assertEqual(other_pref.maximum_capacity, 3)
         self.assertEqual(other_pref.free_form, "carol's note")
 
-    def test_away_until_is_interpreted_in_the_resolved_timezone(self) -> None:
+    # ---- timezone ------------------------------------------------------
+    # The page renders times in the server's default zone and posts back, as `timezone`, the zone its
+    # times are in; prefs_form.js swaps both to the browser's zone. These pin the server's half.
+
+    def test_away_until_is_read_in_the_posted_timezone(self) -> None:
         self._login_session()
         data, index_by_id = self._post_data()
         i1 = index_by_id[self.pref1.id]
+        data["timezone"] = "Europe/Berlin"
         data[f"form-{i1}-away_until"] = "2026-03-01T09:00"
 
-        with patch("console.views.resolve_user_timezone_name", return_value="Europe/Berlin"):
-            resp = self.client.post(self.url, data=data)
+        resp = self.client.post(self.url, data=data)
 
         self.assertEqual(resp.status_code, 302)
         self.pref1.refresh_from_db()
-        self.assertEqual(
-            self.pref1.away_until.astimezone(dt_timezone.utc),
-            datetime(2026, 3, 1, 8, 0, tzinfo=dt_timezone.utc),
-        )
+        self.assertEqual(self.pref1.away_until, datetime(2026, 3, 1, 8, 0, tzinfo=dt_timezone.utc))
+
+    @override_settings(TIME_ZONE="UTC")
+    def test_away_until_without_a_posted_timezone_is_read_in_the_server_zone(self) -> None:
+        # A page rendered before this field existed, or a hand-rolled POST.
+        self._login_session()
+        data, index_by_id = self._post_data()
+        i1 = index_by_id[self.pref1.id]
+        data[f"form-{i1}-away_until"] = "2026-03-01T09:00"
+
+        resp = self.client.post(self.url, data=data)
+
+        self.assertEqual(resp.status_code, 302)
+        self.pref1.refresh_from_db()
+        self.assertEqual(self.pref1.away_until, datetime(2026, 3, 1, 9, 0, tzinfo=dt_timezone.utc))
+
+    def test_an_unknown_posted_timezone_saves_nothing(self) -> None:
+        # Every typed time would be misread, so the save is refused, not read in some other zone. The
+        # names cover each way ZoneInfo refuses a key: unknown, malformed, a directory, too long.
+        self._login_session()
+        for name in ("Mars/Olympus_Mons", "../etc/passwd", "Europe", "x" * 300):
+            with self.subTest(name=name[:20]):
+                data, index_by_id = self._post_data()
+                data["timezone"] = name
+                data[f"form-{index_by_id[self.pref1.id]}-maximum_capacity"] = "3"
+
+                resp = self.client.post(self.url, data=data)
+
+                self.assertContains(resp, "Nothing was saved", status_code=200)
+                self.pref1.refresh_from_db()
+                self.assertEqual(self.pref1.maximum_capacity, 10)
+
+    @override_settings(TIME_ZONE="UTC")
+    def test_away_until_round_trips_as_rendered_and_as_the_browser_rewrites_it(self) -> None:
+        # Posting the time back unchanged must leave it where it was, whichever zone it was shown in.
+        stored = datetime(2027, 7, 1, 10, 0, tzinfo=dt_timezone.utc)
+        ReviewerPreference.objects.filter(pk=self.pref1.pk).update(away_until=stored)
+        self._login_session()
+        data, index_by_id = self._post_data()
+        i1 = index_by_id[self.pref1.id]
+
+        page = self.client.get(self.url)
+        self.assertContains(page, 'name="timezone" id="prefs-timezone" value="UTC"')
+        self.assertContains(page, 'data-utc="2027-07-01T10:00:00+00:00"')
+        match = re.search(rf'name="form-{i1}-away_until" value="([^"]*)"', page.content.decode())
+        self.assertIsNotNone(match)
+        self.assertEqual(match.group(1), "2027-07-01T10:00")
+
+        for zone, shown in (("UTC", match.group(1)), ("Europe/Berlin", "2027-07-01T12:00")):
+            with self.subTest(zone=zone):
+                data["timezone"] = zone
+                data[f"form-{i1}-away_until"] = shown
+                # A change elsewhere in the row, so the row is saved and `away_until` rewritten.
+                data[f"form-{i1}-free_form"] = f"shown in {zone}"
+
+                resp = self.client.post(self.url, data=data)
+
+                self.assertEqual(resp.status_code, 302)
+                self.pref1.refresh_from_db()
+                self.assertEqual(self.pref1.away_until, stored)
+
+    @override_settings(TIME_ZONE="UTC")
+    def test_saved_time_is_a_time_element_for_the_browser_to_localize(self) -> None:
+        self._login_session()
+        # In the past on purpose: the session was issued against the real clock, so a frozen "now"
+        # after its expiry would bounce the request to sign-in.
+        frozen_now = datetime(2026, 7, 1, 10, 0, 30, 123456, tzinfo=dt_timezone.utc)
+
+        with patch("django.utils.timezone.now", return_value=frozen_now):
+            resp = self.client.get(f"{self.url}?saved=1")
+
+        self.assertContains(resp, 'Preferences saved at <time datetime="2026-07-01T10:00:30+00:00">2026-07-01 10:00 UTC</time>.')
 
-    def test_timezone_resolution_uses_the_reviewers_zulip_link(self) -> None:
+    def test_the_page_makes_no_zulip_call(self) -> None:
+        # The zone comes from the browser; the page used to ask Zulip for it on every render.
         self._login_session()
-        with patch("console.views.resolve_user_timezone_name", return_value="UTC") as resolver:
+        with patch("zulip_bot.services.zulip_client.ZulipClient.get_user_by_id") as get_user:
             self.client.get(self.url)
-        resolver.assert_called_once_with(user=self.reviewer)
+        get_user.assert_not_called()
 
     def test_home_links_to_the_prefs_page(self) -> None:
         self._login_session()
diff --git a/qb_site/console/views.py b/qb_site/console/views.py
index 5957039c..650fd0e4 100644
--- a/qb_site/console/views.py
+++ b/qb_site/console/views.py
@@ -12,7 +12,7 @@
 import logging
 import secrets
 from typing import Iterable, Sequence
-from zoneinfo import ZoneInfo
+from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
 
 from django.conf import settings
 from django.db import transaction
@@ -72,12 +72,6 @@
 from core.services.site_urls import build_site_url
 from syncer.models import PRLabel, PullRequest
 
-# The reviewer's timezone comes from Zulip's own user record, so the resolver lives in `zulip_bot`
-# (see `zulip_bot.services.user_timezone`). Console access itself stays independent of Zulip
-# reachability — an unlinked or unreachable Zulip only falls through to `core.User.timezone`, then the
-# project default.
-from zulip_bot.services.user_timezone import resolve_user_timezone_name
-
 log = logging.getLogger(__name__)
 
 # Shown to a GitHub account we cannot let in: unknown to us, a recycled login, or known but not a
@@ -406,6 +400,19 @@ def _recent_intake_by_repo(preferences: Sequence[ReviewerPreference]) -> dict[in
     return intake
 
 
+def _zone_or_none(name: str) -> ZoneInfo | None:
+    """The zone named ``name``, or ``None`` when this server cannot load it.
+
+    ``name`` is posted by the browser, so every way ``ZoneInfo`` refuses a key counts as unknown: no
+    such zone, a malformed key (``ValueError``), or one that trips over the filesystem, such as the
+    directory ``Europe`` or an over-long name (``OSError``).
+    """
+    try:
+        return ZoneInfo(name)
+    except (ZoneInfoNotFoundError, ValueError, OSError):
+        return None
+
+
 @require_http_methods(["GET", "POST"])
 def prefs(request: HttpRequest) -> HttpResponse:
     """Reviewer preferences at a stable, token-less URL (design doc 022).
@@ -423,38 +430,45 @@ def prefs(request: HttpRequest) -> HttpResponse:
         return redirect(_login_url(reverse("console:prefs")))
 
     preferences = preferences_for_user(reviewer)
-    user_timezone_name = resolve_user_timezone_name(user=reviewer)
-    user_timezone = ZoneInfo(user_timezone_name)
+    # The page's times are in the zone its form posts back as `timezone`: the server default as
+    # rendered, which prefs_form.js swaps for the browser's zone as it rewrites the times. Reading a
+    # POST in the zone it names stores the time the reviewer saw. A zone this server cannot load would
+    # misread every typed time, so then nothing is saved.
+    timezone_name = timezone.get_default_timezone_name()
+    if request.method == "POST":
+        timezone_name = str(request.POST.get("timezone") or "").strip() or timezone_name
+    page_timezone = _zone_or_none(timezone_name)
+    active_timezone = page_timezone or timezone.get_default_timezone()
 
     saved = request.method == "GET" and request.GET.get("saved") == "1"
-    saved_at = None
     formset = None
-    with timezone.override(user_timezone):
+    # Render inside the override too, not just validate: the `date` filter and the `away_until` widget
+    # convert aware datetimes to the zone active *at render time*.
+    with timezone.override(active_timezone):
         if preferences:
             formset = build_preferences_formset(
                 preferences=preferences,
-                user_timezone=user_timezone,
+                user_timezone=active_timezone,
                 data=request.POST if request.method == "POST" else None,
                 recent_intake_by_repo=_recent_intake_by_repo(preferences),
             )
-            if request.method == "POST" and formset.is_valid():
+            if request.method == "POST" and page_timezone is not None and formset.is_valid():
                 formset.save()
                 return redirect(f"{reverse('console:prefs')}?saved=1")
-        if saved:
-            saved_at = timezone.localtime(timezone.now(), user_timezone)
 
-    response = render(
-        request,
-        "console/prefs.html",
-        {
-            "reviewer": reviewer,
-            "formset": formset,
-            "saved": saved,
-            "saved_at": saved_at,
-            "user_timezone_name": user_timezone_name,
-            "logout_url": reverse("console:logout"),
-        },
-    )
+        response = render(
+            request,
+            "console/prefs.html",
+            {
+                "reviewer": reviewer,
+                "formset": formset,
+                "saved": saved,
+                "saved_at": timezone.now().replace(microsecond=0) if saved else None,
+                "timezone_name": timezone_name,
+                "timezone_unknown": page_timezone is None,
+                "logout_url": reverse("console:logout"),
+            },
+        )
     response["Cache-Control"] = "no-store"
     return response
 
diff --git a/qb_site/core/forms.py b/qb_site/core/forms.py
index b259e4b1..6d2d736e 100644
--- a/qb_site/core/forms.py
+++ b/qb_site/core/forms.py
@@ -247,11 +247,16 @@ def __init__(
         # The picker's list: the whole catalog, sorted the way the topic checkboxes are.
         self.excluded_label_options = sorted(self._label_catalog_by_casefold.values(), key=str.casefold)
 
-        tz_label = getattr(self._user_timezone, "key", str(self._user_timezone))
         community_team_page_warning = mark_safe(
             "<b>Publicly visible on <a href='https://leanprover-community.github.io/teams/reviewers.html'>the community team page</a>.</b>"
         )
-        self.fields["away_until"].help_text = f"Temporary break end time. Leave blank if active. Interpreted in {tz_label}."
+        self.fields[
+            "away_until"
+        ].help_text = "Temporary break end time, in the timezone named above the form. Leave blank if active."
+        # The stored instant, from which the console's prefs_form.js shows this time in the browser's zone
+        # (design doc 022). Per form: Django deep-copies each field's widget for every form instance.
+        if self.instance.away_until is not None:
+            self.fields["away_until"].widget.attrs["data-utc"] = self.instance.away_until.isoformat(timespec="seconds")
         self.fields["auto_assign"].help_text = "Turn this off to opt out of automatic reviewer assignment for this repository."
         # The two capacity gates sit side by side in the grid and are easy to confuse, so each says
         # which kind of limit it is: this one bounds the PRs held at once (stock), the next bounds
diff --git a/qb_site/core/services/reviewer_prefs.py b/qb_site/core/services/reviewer_prefs.py
index 5b50157f..80c43da2 100644
--- a/qb_site/core/services/reviewer_prefs.py
+++ b/qb_site/core/services/reviewer_prefs.py
@@ -56,7 +56,7 @@ def build_preferences_formset(
     """Build the formset over ``preferences`` (already authorized by the caller).
 
     ``data`` bound → a POST; ``None`` → a fresh render. ``user_timezone`` is what naive
-    ``away_until`` input is interpreted in (see ``zulip_bot.services.user_timezone``).
+    ``away_until`` input is interpreted in: the zone the page was shown in (see ``console.views.prefs``).
 
     ``recent_intake_by_repo`` (``repository_id -> new PRs in the rolling window``) is displayed
     beside the rate-limit field so a reviewer can pick a number against their own history rather
diff --git a/qb_site/templates/console/prefs.html b/qb_site/templates/console/prefs.html
index 605ca811..f20aa94b 100644
--- a/qb_site/templates/console/prefs.html
+++ b/qb_site/templates/console/prefs.html
@@ -19,7 +19,13 @@ <h1>Reviewer preferences</h1>
 
   {% if saved %}
     <div class="status status-ok" role="status">
-      Preferences saved{% if saved_at %} at {{ saved_at|date:"Y-m-d H:i" }} ({{ user_timezone_name }}){% endif %}.
+      Preferences saved{% if saved_at %} at <time datetime="{{ saved_at.isoformat }}">{{ saved_at|date:"Y-m-d H:i" }} {{ timezone_name }}</time>{% endif %}.
+    </div>
+  {% endif %}
+  {% if timezone_unknown %}
+    <div class="status status-error" role="alert">
+      Nothing was saved: your browser gave its timezone as “{{ timezone_name }}”, which this server does not
+      recognise, so the times on this page could not be read.
     </div>
   {% endif %}
 
@@ -32,14 +38,20 @@ <h1>Reviewer preferences</h1>
     `prefs-root` and `prefs-form` are the ids console/prefs_form.js mounts on. No countdown: the
     session bounds this page, not a link TTL. Note Django only strips {# #} comments on a single line
     — anything multi-line must use {% comment %} or it renders as page text.
+
+    Times render in `timezone_name`, which the hidden `prefs-timezone` field posts back. prefs_form.js
+    rewrites the times into the browser's zone and sets that field (and each `js-timezone-name`) to
+    it, so the server always reads a time in the zone it was shown in. `autocomplete="off"` keeps a
+    reload from restoring the browser's zone over a page rendered in the server's.
     {% endcomment %}
     <div id="prefs-root">
       {# `.meta` is hero-only (pale text for the dark gradient); this strip is the light-background idiom. #}
       <section class="form-context">
-        <span>Times are entered and shown in <strong>{{ user_timezone_name }}</strong></span>
+        <span>Times are entered and shown in <strong class="js-timezone-name">{{ timezone_name }}</strong></span>
       </section>
       <form method="post" id="prefs-form">
         {% csrf_token %}
+        <input type="hidden" name="timezone" id="prefs-timezone" value="{{ timezone_name }}" autocomplete="off">
         {% include "shared/_reviewer_prefs_fields.html" %}
 
         <div class="btn-row">
diff --git a/qb_site/zulip_bot/AGENTS.md b/qb_site/zulip_bot/AGENTS.md
index 38ace03c..5abc813f 100644
--- a/qb_site/zulip_bot/AGENTS.md
+++ b/qb_site/zulip_bot/AGENTS.md
@@ -98,16 +98,11 @@ post a reply there. `console` is the deliberate exception, an in-place reply by
     differ per action, and they stay per-action so a `label-pr` token can never validate as a
     `close-pr` one. Commands read the DM's quoted expiry from its `ttl_seconds()` rather than
     re-reading the setting, so the promise and the real `exp` cannot drift),
-  - `user_timezone.py` (the timezone a reviewer's local times are interpreted in: Zulip's reported
-    zone → `core.User.timezone` → Django default). Shared with the console prefs page so a naive
-    `away_until` means the same thing on both; it lives here because the authoritative source is
-    Zulip's user record, and `core` carries no app dependencies.
 - **This app does not own the preferences form.** It lives in the reviewer console
   (`/console/preferences/`, design doc 022): `core.forms.ReviewerPreferenceForm` owns the editable
   fields and validation, `core.services.reviewer_prefs` the formset assembly, and
   `templates/shared/_reviewer_prefs_fields.html` the markup. The expiring `prefs` token page here was
-  retired; this app's remaining role is the `prefs` command (which DMs the console URL) and the
-  timezone resolver above.
+  retired; this app's remaining role is the `prefs` command (which DMs the console URL).
 - `views.register_github_callback` **opens the console session** (`console.session.set_reviewer`) when
   the new reviewer has rows to edit, so the "Edit Preferences Now" link lands signed in instead of
   bouncing through OAuth again. That promotion is strictly stronger than a console sign-in:
diff --git a/qb_site/zulip_bot/frontend/tests/prefs_form.test.js b/qb_site/zulip_bot/frontend/tests/prefs_form.test.js
index 7924d60a..ac1d7cbf 100644
--- a/qb_site/zulip_bot/frontend/tests/prefs_form.test.js
+++ b/qb_site/zulip_bot/frontend/tests/prefs_form.test.js
@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
-import { mountLabelPicker, mountPrefsForm } from "../../../console/static/console/prefs_form.js";
+import { mountLabelPicker, mountPrefsForm, toDatetimeLocalValue } from "../../../console/static/console/prefs_form.js";
 
 describe("mountPrefsForm", () => {
   it("wires the clear-away buttons and leaves submit enabled", () => {
@@ -67,6 +67,68 @@ describe("mountPrefsForm", () => {
   });
 });
 
+// Times in the browser's zone (design doc 022). The markup mirrors `prefs.html` and the `away_until`
+// widget from `ReviewerPreferenceForm`.
+describe("browser timezone", () => {
+  const renderPage = ({ zone, away, utc }) => {
+    document.body.innerHTML = `
+      <main id="prefs-root">
+        <p>Times are entered and shown in <strong class="js-timezone-name">${zone}</strong></p>
+        <form id="prefs-form">
+          <input type="hidden" id="prefs-timezone" name="timezone" value="${zone}" />
+          <input type="datetime-local" id="away" name="form-0-away_until" value="${away}" data-utc="${utc}" />
+          <button id="submit-button" type="submit">Save</button>
+        </form>
+      </main>
+    `;
+  };
+  const shown = () => ({
+    away: document.getElementById("away").value,
+    zone: document.getElementById("prefs-timezone").value,
+    label: document.querySelector(".js-timezone-name").textContent,
+  });
+
+  it("formats an instant on another zone's wall clock", () => {
+    const instant = new Date("2027-07-01T10:00:00+00:00");
+    expect(toDatetimeLocalValue(instant, "Europe/Berlin")).toBe("2027-07-01T12:00");
+    expect(toDatetimeLocalValue(instant, "America/New_York")).toBe("2027-07-01T06:00");
+    expect(toDatetimeLocalValue(new Date("2027-01-01T23:30:00+00:00"), "Europe/Berlin")).toBe("2027-01-02T00:30");
+  });
+
+  it("rewrites the server's times into the browser's zone and posts that zone back", () => {
+    renderPage({ zone: "UTC", away: "2027-07-01T10:00", utc: "2027-07-01T10:00:00+00:00" });
+    const unmount = mountPrefsForm(document, "Europe/Berlin");
+
+    expect(shown()).toEqual({ away: "2027-07-01T12:00", zone: "Europe/Berlin", label: "Europe/Berlin" });
+    // The rewrite is not an unsaved change.
+    const event = new Event("beforeunload", { cancelable: true });
+    window.dispatchEvent(event);
+    expect(event.defaultPrevented).toBe(false);
+    unmount();
+  });
+
+  it("keeps what was typed on a page already in the browser's zone", () => {
+    // A re-render after a failed save shows the posted value, in the zone it was posted in.
+    renderPage({ zone: "Europe/Berlin", away: "2027-07-02T08:00", utc: "2027-07-01T10:00:00+00:00" });
+    const unmount = mountPrefsForm(document, "Europe/Berlin");
+
+    expect(shown()).toEqual({ away: "2027-07-02T08:00", zone: "Europe/Berlin", label: "Europe/Berlin" });
+    unmount();
+  });
+
+  it("stays in the server's zone when the browser gives none or a time cannot be read", () => {
+    renderPage({ zone: "UTC", away: "2027-07-01T10:00", utc: "2027-07-01T10:00:00+00:00" });
+    let unmount = mountPrefsForm(document, "");
+    expect(shown()).toEqual({ away: "2027-07-01T10:00", zone: "UTC", label: "UTC" });
+    unmount();
+
+    renderPage({ zone: "UTC", away: "2027-07-01T10:00", utc: "not a time" });
+    unmount = mountPrefsForm(document, "Europe/Berlin");
+    expect(shown()).toEqual({ away: "2027-07-01T10:00", zone: "UTC", label: "UTC" });
+    unmount();
+  });
+});
+
 // The excluded-labels picker (design doc 057). The markup mirrors `_reviewer_prefs_fields.html`.
 const CATALOG = ["LLM-generated", "needs-review, blocked", "t-algebra", "t-algebraic-geometry", "WIP"];
 
diff --git a/qb_site/zulip_bot/services/user_timezone.py b/qb_site/zulip_bot/services/user_timezone.py
deleted file mode 100644
index f846867f..00000000
--- a/qb_site/zulip_bot/services/user_timezone.py
+++ /dev/null
@@ -1,76 +0,0 @@
-"""Resolve the timezone to interpret a reviewer's local times in.
-
-Lives in ``zulip_bot`` because the authoritative source is Zulip's own user record (which Zulip
-derives from the user's browser); ``core`` stays free of app dependencies. Consumed by the reviewer
-console's preferences page, where it decides what the naive ``datetime-local`` ``away_until`` input
-means (design doc 022).
-
-Resolution order: Zulip's reported timezone → ``core.User.timezone`` → the Django default. A missing
-Zulip link (or an unconfigured/unreachable Zulip) simply falls through; it is never an error. Note
-``core.User.timezone`` is currently only ever set by hand in the Django admin, so in practice the
-fallback is the project default until we persist a browser-reported zone (022, deferred).
-"""
-
-from __future__ import annotations
-
-import logging
-from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
-
-from django.conf import settings
-from django.utils import timezone
-
-from core.models import User
-from zulip_bot.services.zulip_client import ZulipApiError, ZulipClient
-
-logger = logging.getLogger(__name__)
-
-
-def resolve_user_timezone_name(*, user: User, zulip_user_id: int | None = None) -> str:
-    """Return an IANA timezone name for ``user``, preferring what Zulip reports.
-
-    ``zulip_user_id`` defaults to the user's own linked Zulip id; pass it explicitly when the caller
-    holds a verified id from elsewhere (the prefs token carries one).
-    """
-    lookup_id = zulip_user_id if zulip_user_id is not None else user.zulip_user_id
-    if lookup_id is not None:
-        zulip_tz_name = fetch_zulip_user_timezone_name(int(lookup_id))
-        if zulip_tz_name:
-            return zulip_tz_name
-    if user.timezone and is_valid_timezone_name(user.timezone):
-        return user.timezone
-    return timezone.get_default_timezone_name()
-
-
-def fetch_zulip_user_timezone_name(zulip_user_id: int) -> str | None:
-    base_url = getattr(settings, "ZULIP_BASE_URL", "").strip()
-    bot_email = getattr(settings, "ZULIP_BOT_EMAIL", "").strip()
-    bot_api_key = getattr(settings, "ZULIP_BOT_API_KEY", "").strip()
-    if not base_url or not bot_email or not bot_api_key:
-        return None
-    try:
-        payload = ZulipClient().get_user_by_id(zulip_user_id)
-    except ZulipApiError:
-        logger.exception("zulip_timezone_lookup_failed", extra={"zulip_user_id": zulip_user_id})
-        return None
-    user = payload.get("user")
-    if not isinstance(user, dict):
-        return None
-    timezone_name = user.get("timezone")
-    if isinstance(timezone_name, str) and is_valid_timezone_name(timezone_name):
-        return timezone_name
-    return None
-
-
-def is_valid_timezone_name(value: str) -> bool:
-    try:
-        ZoneInfo(value)
-    except ZoneInfoNotFoundError:
-        return False
-    return True
-
-
-__all__ = [
-    "resolve_user_timezone_name",
-    "fetch_zulip_user_timezone_name",
-    "is_valid_timezone_name",
-]
diff --git a/qb_site/zulip_bot/tests/test_user_timezone.py b/qb_site/zulip_bot/tests/test_user_timezone.py
deleted file mode 100644
index 3eea4f2e..00000000
--- a/qb_site/zulip_bot/tests/test_user_timezone.py
+++ /dev/null
@@ -1,75 +0,0 @@
-"""The timezone chain behind every reviewer-facing local time (design docs 022, 050).
-
-`away_until` is entered as a naive `datetime-local`, so what this resolves to decides what a
-reviewer's break time actually means. Zulip's own user record is the authority; the fallbacks exist
-for reviewers with no Zulip link (e.g. created by `import_reviewer_topics`).
-"""
-
-from __future__ import annotations
-
-from unittest.mock import patch
-
-from django.test import SimpleTestCase, TestCase, override_settings
-
-from core.models import User
-from zulip_bot.services.user_timezone import is_valid_timezone_name, resolve_user_timezone_name
-from zulip_bot.services.zulip_client import ZulipApiError
-
-
-@override_settings(
-    ZULIP_BASE_URL="https://zulip.example",
-    ZULIP_BOT_EMAIL="bot@example.com",
-    ZULIP_BOT_API_KEY="key",
-    TIME_ZONE="UTC",
-)
-class ResolveUserTimezoneNameTests(TestCase):
-    def test_prefers_the_zone_zulip_reports(self) -> None:
-        user = User.objects.create(github_login="reviewer", zulip_user_id=101, timezone="America/New_York")
-        with patch(
-            "zulip_bot.services.user_timezone.ZulipClient.get_user_by_id",
-            return_value={"user": {"timezone": "Europe/Berlin"}},
-        ):
-            self.assertEqual(resolve_user_timezone_name(user=user), "Europe/Berlin")
-
-    def test_explicit_zulip_id_overrides_the_stored_link(self) -> None:
-        # The caller may hold a verified id from elsewhere; it must win over the user's own field.
-        user = User.objects.create(github_login="reviewer", zulip_user_id=101)
-        with patch(
-            "zulip_bot.services.user_timezone.ZulipClient.get_user_by_id",
-            return_value={"user": {"timezone": "Europe/Berlin"}},
-        ) as lookup:
-            resolve_user_timezone_name(user=user, zulip_user_id=999)
-        lookup.assert_called_once_with(999)
-
-    def test_falls_back_to_the_stored_user_timezone(self) -> None:
-        user = User.objects.create(github_login="reviewer", zulip_user_id=101, timezone="America/New_York")
-        with patch("zulip_bot.services.user_timezone.ZulipClient.get_user_by_id", side_effect=ZulipApiError("boom")):
-            self.assertEqual(resolve_user_timezone_name(user=user), "America/New_York")
-
-    def test_falls_back_to_the_project_default(self) -> None:
-        # No Zulip link at all — the importer-created reviewer case.
-        user = User.objects.create(github_login="reviewer")
-        self.assertEqual(resolve_user_timezone_name(user=user), "UTC")
-
-    def test_ignores_an_invalid_zone_from_zulip(self) -> None:
-        user = User.objects.create(github_login="reviewer", zulip_user_id=101, timezone="America/New_York")
-        with patch(
-            "zulip_bot.services.user_timezone.ZulipClient.get_user_by_id",
-            return_value={"user": {"timezone": "Mars/Olympus_Mons"}},
-        ):
-            self.assertEqual(resolve_user_timezone_name(user=user), "America/New_York")
-
-    def test_ignores_an_invalid_stored_zone(self) -> None:
-        user = User.objects.create(github_login="reviewer", timezone="Mars/Olympus_Mons")
-        self.assertEqual(resolve_user_timezone_name(user=user), "UTC")
-
-    @override_settings(ZULIP_BASE_URL="", ZULIP_BOT_EMAIL="", ZULIP_BOT_API_KEY="")
-    def test_unconfigured_zulip_is_not_an_error(self) -> None:
-        user = User.objects.create(github_login="reviewer", zulip_user_id=101, timezone="America/New_York")
-        self.assertEqual(resolve_user_timezone_name(user=user), "America/New_York")
-
-
-class IsValidTimezoneNameTests(SimpleTestCase):
-    def test_accepts_known_zones_and_rejects_junk(self) -> None:
-        self.assertTrue(is_valid_timezone_name("Europe/Berlin"))
-        self.assertFalse(is_valid_timezone_name("Mars/Olympus_Mons"))