diff --git a/CHANGELOG.md b/CHANGELOG.md
index 094b546..87550dc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## 2.11.1
+
+### Changed: bump pinned Coana CLI to 15.12.10
+
+- Bumped the pinned reachability engine (the Coana CLI) from `15.12.8` to
+  `15.12.10`. See the
+  [reachability analysis changelog](https://docs.socket.dev/docs/reachability-analysis-changelog)
+  for engine changes.
+
 ## 2.11.0
 
 ### Changed: download the Coana CLI from Socket instead of npm
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index 7b045a3..547542a 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -338,7 +338,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.12.8 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.12.10 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
diff --git a/pyproject.toml b/pyproject.toml
index be5d1f3..74ee72d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.11.0"
+version = "2.11.1"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 8850b2e..4b0b8f4 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.11.0'
+__version__ = '2.11.1'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/tools/coana-cache.mjs b/socketsecurity/core/tools/coana-cache.mjs
index 52423b7..c21a95e 100644
--- a/socketsecurity/core/tools/coana-cache.mjs
+++ b/socketsecurity/core/tools/coana-cache.mjs
@@ -99,14 +99,19 @@ function indexFile(version, component) {
   return join2(cacheRoot(), "versions", versionSegment(version), component);
 }
 async function lookup(version, component) {
-  const sha256 = (await readFile(indexFile(version, component), "utf8").catch(() => "")).trim();
+  const index = indexFile(version, component);
+  const sha256 = (await readFile(index, "utf8").catch(() => "")).trim();
   if (!SHA256.test(sha256)) return void 0;
   const dir = objectDir(sha256);
   const isDirectory = await stat(dir).then(
     (s) => s.isDirectory(),
     () => false
   );
-  return isDirectory ? dir : void 0;
+  if (!isDirectory) return void 0;
+  const now = /* @__PURE__ */ new Date();
+  await utimes(index, now, now).catch(() => writeFileAtomically(index, sha256)).catch(() => {
+  });
+  return dir;
 }
 async function install(version, component, sha256, populate) {
   if (!SHA256.test(sha256)) throw new InvalidCacheKey(`Invalid SHA-256: ${sha256}`);
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index c03cea6..75593d6 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -22,7 +22,7 @@
 # Pinned Coana CLI version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.12.8"
+DEFAULT_COANA_CLI_VERSION: Final = "15.12.10"
 
 # Vendored from coana-package-manager, where it is generated; the only code that may read or
 # write the cache Coana shares with the Socket CLIs. See "Launching Coana" in that repo's
diff --git a/uv.lock b/uv.lock
index 7d88693..b100aac 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1292,7 +1292,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.11.0"
+version = "2.11.1"
 source = { editable = "." }
 dependencies = [
     { name = "beautifulsoup4" },