diff --git a/cmd/check-ip/main.go b/cmd/check-ip/main.go
index 0e3fa32..6bf9b99 100644
--- a/cmd/check-ip/main.go
+++ b/cmd/check-ip/main.go
@@ -54,7 +54,7 @@ func main() {
 	fs.StringVar(&cfg.Bind, "serve", "", "bind address for the HTTP API, e.g. :8080")
 	fs.StringVar(&cfg.GeoIPConfPath, "geoip-conf", "", "path to GeoIP.conf (default: ./GeoIP.conf or ~/.config/maxmind/GeoIP.conf)")
 	fs.StringVar(&cfg.RepoURL, "blocklist-repo", defaultBlocklistRepo, "git URL of the blocklist repo (must match bitwire-it layout)")
-	fs.StringVar(&cfg.CacheDir, "cache-dir", "", "cache parent dir, holds bitwire-it/ and maxmind/ subdirs (default: OS user cache)")
+	fs.StringVar(&cfg.CacheDir, "cache-dir", "", "cache parent dir, holds bitwire-it/ and maxmind/ subdirs (default: ~/.cache)")
 	fs.StringVar(&cfg.WhitelistPath, "whitelist", "", "path to a file of IPs and/or CIDRs (one per line) that override block decisions")
 	fs.Usage = func() {
 		fmt.Fprintf(os.Stderr, "Usage: %s [flags] <ip> [ip...]\n", os.Args[0])
@@ -88,11 +88,11 @@ func main() {
 		os.Exit(1)
 	}
 	if cfg.CacheDir == "" {
-		d, err := os.UserCacheDir()
+		home, err := os.UserHomeDir()
 		if err != nil {
 			log.Fatalf("cache-dir: %v", err)
 		}
-		cfg.CacheDir = d
+		cfg.CacheDir = filepath.Join(home, ".cache")
 	}
 
 	// GeoIP config discovery: explicit --geoip-conf wins; otherwise check the
diff --git a/net/geoip/geoip.go b/net/geoip/geoip.go
index fe8df2e..c4490d4 100644
--- a/net/geoip/geoip.go
+++ b/net/geoip/geoip.go
@@ -33,12 +33,14 @@ func DefaultConfPaths() []string {
 	return paths
 }
 
-// DefaultCacheDir returns the OS cache directory for MaxMind databases,
-// e.g. ~/.cache/maxmind on Linux or ~/Library/Caches/maxmind on macOS.
+// DefaultCacheDir returns ~/.cache/maxmind. CLI tools use the XDG
+// convention on all platforms — os.UserCacheDir's macOS default
+// (~/Library/Caches) is meant for bundled desktop apps and hides the
+// files from anyone looking under ~/.cache.
 func DefaultCacheDir() (string, error) {
-	base, err := os.UserCacheDir()
+	home, err := os.UserHomeDir()
 	if err != nil {
 		return "", err
 	}
-	return filepath.Join(base, "maxmind"), nil
+	return filepath.Join(home, ".cache", "maxmind"), nil
 }