diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index de8161d..529467c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,9 +52,9 @@ jobs:
       # divergence is itself worth seeing.
       - run: pytest -q -m "not real_card" --cov --cov-report=term-missing --cov-report=xml
       # Second, tighter floor on the layer that actually needs to move: the command
-      # modules hold 1699 of the 2158 missed statements. coverage.py has no per-file
+      # modules hold 1658 of the 2111 missed statements. coverage.py has no per-file
       # fail_under, so this is a separate report over the same data.
-      - run: coverage report --include='src/cryptnox_id_cli/cli/commands/*' --fail-under=36
+      - run: coverage report --include='src/cryptnox_id_cli/cli/commands/*' --fail-under=38
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
         if: ${{ !env.ACT && matrix.python-version == '3.14' }}
         with:
diff --git a/pyproject.toml b/pyproject.toml
index eb71024..c323579 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -116,8 +116,9 @@ branch = true
 show_missing = true
 skip_covered = true
 # NOTE: with branch = true, this gate compares the COMBINED statement-and-branch
-# percentage that `coverage report` prints - not line coverage alone. At the time
-# this gate was introduced the three numbers were 60.25% combined, 64.11% line,
-# 43.62% branch, so reading it as a line-coverage floor overstates the suite by
-# four points. Raise it in the same commit as the tests that earn the increase.
-fail_under = 60
+# percentage that `coverage report` prints - not line coverage alone. Today the
+# three numbers are 61.09% combined, 64.86% line and 44.91% branch, so reading
+# this as a line-coverage floor overstates the suite by nearly four points.
+# Raise it in the same commit as the tests that earn the increase, and never
+# lower it to make a change pass.
+fail_under = 61