diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5eac8f7..37c6572 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -227,9 +227,9 @@ jobs:
     timeout-minutes: 120
     env:
       # openkal 0.23.0, which this release is written against, is the one
-      # openkal-platform 0.23.2's version group names; mcpp 2026.11.3.1 and
+      # openkal-platform 0.23.3's version group names; mcpp 2026.11.3.1 and
       # later pin it for their openkal rows.
-      MCPP_PLATFORM: openkal-platform@0.23.2
+      MCPP_PLATFORM: openkal-platform@0.23.3
     defaults:
       run:
         shell: bash
@@ -279,9 +279,9 @@ jobs:
     timeout-minutes: 45
     env:
       # openkal 0.23.0, which this release is written against, is the one
-      # openkal-platform 0.23.2's version group names; mcpp 2026.11.3.1 and
+      # openkal-platform 0.23.3's version group names; mcpp 2026.11.3.1 and
       # later pin it for their openkal rows.
-      MCPP_PLATFORM: openkal-platform@0.23.2
+      MCPP_PLATFORM: openkal-platform@0.23.3
     strategy:
       fail-fast: false
       matrix:
diff --git a/README.md b/README.md
index 8a9c24d..609fb62 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ with compile-time platform constants and a few platform modules.
 
 ```toml
 [dependencies]
-os = { namespace = "mcpplibs", version = "0.2.8" }
+os = { namespace = "mcpplibs", version = "0.2.9" }
 ```
 
 ```cpp
@@ -169,3 +169,12 @@ target in CI and run under node (`checks/emscripten`).
 ## License
 
 Apache-2.0
+
+## Linux confinement in 0.2.9
+
+The Linux backend is openkal-linux 0.24.1. It requires Landlock ABI 3 before
+claiming confinement, which protects read-only grants against raw file
+truncation. Older ABIs refuse a confinement request before starting a program.
+The backend's ABI probe cache uses atomic accesses during concurrent first
+queries. Hosted and image CI select the matching openkal-platform 0.23.3 group.
+The library's own implementation is unchanged.
diff --git a/checks/hosted/mcpp.toml b/checks/hosted/mcpp.toml
index 56db915..bae0a68 100644
--- a/checks/hosted/mcpp.toml
+++ b/checks/hosted/mcpp.toml
@@ -13,7 +13,7 @@ version = "0.1.0"
 os = { path = "../.." }
 
 [target.'cfg(any(linux, macos, windows))']
-platform = "openkal-platform@0.23.2"
+platform = "openkal-platform@0.23.3"
 
 # The tests are the package's own, each reached by an include from
 # tests/<name>.cpp here (a test program is a file of the package that runs it).
diff --git a/mcpp.toml b/mcpp.toml
index 3172459..f3b2cf3 100644
--- a/mcpp.toml
+++ b/mcpp.toml
@@ -1,7 +1,7 @@
 [package]
 namespace   = "mcpplibs"
 name        = "os"
-version     = "0.2.8"
+version     = "0.2.9"
 description = "mcpplibs.os: a C++ operating-system library over openkal --- processes, files, environment, terminals, directories and local IPC, with compile-time platform constants and a few platform modules."
 license     = "Apache-2.0"
 authors     = ["mcpplibs"]
@@ -15,7 +15,7 @@ repo        = "https://github.com/mcpplibs/os"
 openkal = "0.23.0"
 
 [target.linux.dependencies]
-openkal-linux = "0.24.0"
+openkal-linux = "0.24.1"
 
 [target.macos.dependencies]
 openkal-macos = "0.21.3"