diff --git a/ansible/roles/zot/templates/zot.plist.j2 b/ansible/roles/zot/templates/zot.plist.j2
index 25b7da1..b777fb8 100644
--- a/ansible/roles/zot/templates/zot.plist.j2
+++ b/ansible/roles/zot/templates/zot.plist.j2
@@ -16,6 +16,11 @@
 	<true/>
 	<key>KeepAlive</key>
 	<true/>
+	<key>EnvironmentVariables</key>
+	<dict>
+		<key>PATH</key>
+		<string>/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+	</dict>
 	<key>StandardOutPath</key>
 	<string>{{ zot_log_dir }}/mcquack.zot.out.log</string>
 	<key>StandardErrorPath</key>
diff --git a/docs/changelog.d/bump-zot-v2.1.15.infra.md b/docs/changelog.d/bump-zot-v2.1.15.infra.md
new file mode 100644
index 0000000..67e5ccd
--- /dev/null
+++ b/docs/changelog.d/bump-zot-v2.1.15.infra.md
@@ -0,0 +1 @@
+Upgrade zot container registry from v2.1.13 to v2.1.15 (CVE-2025-30204, open redirect fix). Fix trivy CVE DB downloads by adding /usr/local/bin to LaunchAgent PATH.
diff --git a/docs/reference/services/zot.md b/docs/reference/services/zot.md
index c113695..c309557 100644
--- a/docs/reference/services/zot.md
+++ b/docs/reference/services/zot.md
@@ -1,6 +1,6 @@
 ---
 title: Zot
-modified: 2026-02-21
+modified: 2026-03-14
 tags:
   - service
   - registry
diff --git a/service-versions.yaml b/service-versions.yaml
index f060499..7d03295 100644
--- a/service-versions.yaml
+++ b/service-versions.yaml
@@ -269,8 +269,8 @@ services:
 
   - name: zot
     type: ansible
-    last-reviewed: null
-    current-version: null
+    last-reviewed: 2026-03-14
+    current-version: "v2.1.15"
     upstream-source: https://github.com/project-zot/zot/releases
     notes: Built from source on indri