diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index 1851d92..1dfed43 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -7,7 +7,7 @@
   "plugins": [
     {
       "name": "cocoa",
-      "source": ".",
+      "source": "./",
       "description": "Precise static system graphs and provenance-tagged blast radius for polyglot codebases."
     }
   ]
diff --git a/commands/demo.md b/commands/demo.md
index 8b9d359..370021f 100644
--- a/commands/demo.md
+++ b/commands/demo.md
@@ -4,7 +4,7 @@ description: Run the Online Boutique flagship demo — map a real 11-service pol
 
 Run COCOA's flagship demo end-to-end.
 
-1. Run `cocoa demo` (first run clones the pinned Online Boutique fixture and may
+1. Run `cocoa demo` (if the `cocoa` CLI is unavailable, use `uvx --from git+https://github.com/codellm-devkit/cocoa cocoa demo`) (first run clones the pinned Online Boutique fixture and may
    take minutes; Java analysis downloads a JDK on first use).
 2. Report the results per cocoa:grounding-claims: graph size, every skipped service
    with reason (a C# skip is expected until codeanalyzer-dotnet ships; a Go skip means
diff --git a/pyproject.toml b/pyproject.toml
index 25779f9..1354be5 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -8,7 +8,8 @@ license = { text = "MIT" }
 authors = [{ name = "Rahul Krishna", email = "i.m.ralk@gmail.com" }]
 keywords = ["static-analysis", "mcp", "code-analysis", "call-graph", "cldk"]
 dependencies = [
-    "cldk>=1.4.0,<2",
+    # pinned: the Docker jar workaround (python-sdk#236) hardcodes 1.4.0's layout
+    "cldk==1.4.0",
     "pydantic>=2.10.6,<3",
     "fastmcp>=2.5.1",
     "mcp>=1.9.1",
diff --git a/test/test_plugin_assets.py b/test/test_plugin_assets.py
index 0e88d32..d655e97 100644
--- a/test/test_plugin_assets.py
+++ b/test/test_plugin_assets.py
@@ -31,7 +31,7 @@ def test_marketplace_manifest_lists_cocoa():
     mp = json.loads((ROOT / ".claude-plugin" / "marketplace.json").read_text())
     assert mp["name"] == "cocoa"
     assert mp["plugins"][0]["name"] == "cocoa"
-    assert mp["plugins"][0]["source"] == "."
+    assert mp["plugins"][0]["source"] == "./"
 
 
 def test_skill_frontmatter_follows_superpowers_conventions():