diff --git a/.goreleaser.yml b/.goreleaser.yml
index d2f5799..f74c099 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -44,8 +44,9 @@ builds:
       - -X github.com/open-cli-collective/codereview-cli/internal/version.Version={{.Version}}
       - -X github.com/open-cli-collective/codereview-cli/internal/version.Commit={{.Commit}}
       - -X github.com/open-cli-collective/codereview-cli/internal/version.Date={{.Date}}
-    # macOS code-signing — stable DR so Keychain "Always Allow" survives brew upgrade
-    # (cli-common distribution.md §2A). Logic + identity live in open-cli-collective/.github
+    # macOS code-signing — stable DR avoids ad-hoc identity churn, but self-signed
+    # builds still need the shared Keychain prompt mitigations described in
+    # cli-common/docs/distribution.md §2A. Logic + identity live in open-cli-collective/.github
     # (macos-codesign-setup), which exports CODESIGN_DARWIN_SCRIPT (absolute). Unset in
     # local builds → signing skipped.
     hooks:
diff --git a/go.mod b/go.mod
index 86dad2d..9d25995 100644
--- a/go.mod
+++ b/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/charmbracelet/lipgloss v1.1.0
 	github.com/creack/pty v1.1.24
 	github.com/google/uuid v1.6.0
-	github.com/open-cli-collective/cli-common v0.4.0
+	github.com/open-cli-collective/cli-common v0.4.1
 	github.com/spf13/cobra v1.10.2
 	golang.org/x/sys v0.46.0
 	golang.org/x/term v0.44.0
diff --git a/go.sum b/go.sum
index fbdd19e..92d0e4e 100644
--- a/go.sum
+++ b/go.sum
@@ -111,8 +111,8 @@ github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWb
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/noamcohen97/touchid-go v0.3.0 h1:fcXxVCizysD7KHRR6hrURt3nyNIs5JBGSbOIidD/3wo=
 github.com/noamcohen97/touchid-go v0.3.0/go.mod h1:X9MRNIBGEmPqwpDm1G3fQOAQX7fwBlhzUbnkDTxuta0=
-github.com/open-cli-collective/cli-common v0.4.0 h1:YkffqDW2OmFMWPqrT7m/yC3VoUKxGRAp26i2QZMYIWo=
-github.com/open-cli-collective/cli-common v0.4.0/go.mod h1:3AzjCT0V8xgslHlGi1+rUkcV+Vf5wONGwISQkufLZLQ=
+github.com/open-cli-collective/cli-common v0.4.1 h1:6oNaUVmMtXWi4pJn1X+W6KZVDP/WAJwbyZUyxYpGdbQ=
+github.com/open-cli-collective/cli-common v0.4.1/go.mod h1:3AzjCT0V8xgslHlGi1+rUkcV+Vf5wONGwISQkufLZLQ=
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=