Deck stores duedate as a zoneless DATETIME holding UTC wall-clock time, and Entity hydrates it in PHP's default zone. That is only correct because Nextcloud forces the default to UTC; pin the wall clock to UTC explicitly so the overdue check compares real instants either way.