diff --git a/dashy/falco-alerts-to-dashy.py b/dashy/falco-alerts-to-dashy.py
index b7e5c1b..1c9c693 100755
--- a/dashy/falco-alerts-to-dashy.py
+++ b/dashy/falco-alerts-to-dashy.py
@@ -8,14 +8,17 @@ netdata's existing alert-transitions API - the same data already driving
 the Telegram pipeline - so this adds zero new attack surface or
 dependencies.
 """
+import datetime
 import json
 import time
 import urllib.request
+from zoneinfo import ZoneInfo
 
 NETDATA_URL = "http://192.168.1.67:19999"
 OUTPUT_PATH = "/srv/dashy/json-data/falco-alerts.json"
 LOOKBACK_SECONDS = 7 * 86400  # 7 days
-MAX_ENTRIES = 20
+MAX_ENTRIES = 5
+LOCAL_TZ = ZoneInfo("America/New_York")
 
 
 def fetch_transitions():
@@ -32,6 +35,7 @@ def fetch_transitions():
 def to_dashy_entry(t):
     rule_name = t["summary"].removeprefix("Falco rule fired - ")
     status = t["new"]["status"]
+    local_time = datetime.datetime.fromtimestamp(t["when"], LOCAL_TZ).strftime("%-I:%M %p")
     return {
         "link": {
             "text": "View",
@@ -39,7 +43,7 @@ def to_dashy_entry(t):
             "title": f"{status}: {rule_name}",
         },
         "value": {
-            "text": f"{status} - {rule_name}",
+            "text": f"{local_time} - {status} - {rule_name}",
             "title": "Falco",
         },
         "date": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(t["when"])),