diff --git a/CHANGELOG.md b/CHANGELOG.md
index 21afa40..107edf2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog
 
+## v2.2.1
+
+### Features
+
+- `SecurityInsightsFilenames()` returns both accepted names, `security-insights.yml` and `security-insights.yaml`, matching the spec
+
+### Deprecations
+
+- `SecurityInsightsFilename` names only the `.yml` file. Use `SecurityInsightsFilenames()` instead
+
+### Bug Fixes
+
+- `in-scope` and `out-of-scope` load as string lists. Files that set either field no longer fail to load ([#68](https://github.com/ossf/si-tooling/issues/68))
+
 ## v2.1.0
 
 This release is made in concert with the v2.1.0 release of [Security Insights](https://github.com/ossf/security-insights-spec)
diff --git a/v2/si/security_insights.go b/v2/si/security_insights.go
index 594ad0a..d77f793 100644
--- a/v2/si/security_insights.go
+++ b/v2/si/security_insights.go
@@ -13,8 +13,17 @@ import (
 )
 
 // SecurityInsightsFilename is the expected name of the YAML file containing the insights data. See https://github.com/ossf/security-insights-spec?tab=readme-ov-file#usage for more details.
+//
+// Deprecated: the spec accepts both .yml and .yaml. Use SecurityInsightsFilenames.
 const SecurityInsightsFilename = "security-insights.yml"
 
+// SecurityInsightsFilenames returns every name a SecurityInsights YAML file may
+// use. The historical .yml name comes first, so callers that stop at the first
+// match keep their current behavior. A project should keep only one of them.
+func SecurityInsightsFilenames() []string {
+	return []string{SecurityInsightsFilename, "security-insights.yaml"}
+}
+
 func fetchParentSecurityInsights(parentUrl string) (bytes []byte, err error) {
 	request, err := http.NewRequest("GET", parentUrl, nil)
 	if err != nil {
diff --git a/v2/si/security_insights_test.go b/v2/si/security_insights_test.go
index 8719e71..aec17ab 100644
--- a/v2/si/security_insights_test.go
+++ b/v2/si/security_insights_test.go
@@ -125,6 +125,17 @@ func TestNewURL(t *testing.T) {
 		})
 	}
 }
+
+func TestSecurityInsightsFilenames(t *testing.T) {
+	assert.Equal(t, []string{"security-insights.yml", "security-insights.yaml"}, SecurityInsightsFilenames())
+
+	t.Run("returns a fresh slice", func(t *testing.T) {
+		names := SecurityInsightsFilenames()
+		names[0] = "changed"
+		assert.Equal(t, "security-insights.yml", SecurityInsightsFilenames()[0])
+	})
+}
+
 func TestNewEmail(t *testing.T) {
 	tests := []struct {
 		name     string