diff --git a/README.md b/README.md
index 78f5d19..b91312d 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,7 @@
 # wolfSSL Golang Wrapper
 
-This repository contains a very light wrapper around wolfSSL for GO, a server/client example, and some example wolfCrypt applications.
+This repository contains a very light wrapper around wolfSSL for GO, a
+server/client example, and some example wolfCrypt applications.
 
 ## Usage
 
@@ -19,29 +20,39 @@ If you plan to use the `wolftls` subpackage and need concurrent `Read` and
 `Write` on a single `Conn` to run in parallel, add `--enable-writedup` to the
 `./configure` line above. Otherwise, the calls will be serialized.
 
-Then clone the go-wolfssl repo and run the `./generateOptions.sh` script to customize go-wolfssl to the same feature set as wolfSSL. This script will generate an `options.go` file that will keep go-wolfssl and wolfSSL in sync. `generateOptions` should be run any time you change your wolfSSL configure options. If the path to your wolfSSL directory is `../wolfssl`, just run:
+Then clone the go-wolfssl repo and run the `./generateOptions.sh` script to
+customize go-wolfssl to the same feature set as wolfSSL. This script will
+generate an `options.go` file that will keep go-wolfssl and wolfSSL in sync.
+Ideally, `generateOptions` should be run any time the wolfSSL install is
+modified. At minimum, it should be run whenever the configure changes. If the
+path to your wolfSSL directory is `./wolfssl`, just run:
+
 ```
 git clone https://github.com/wolfSSL/go-wolfssl
 cd go-wolfssl
 ./generateOptions.sh
 ```
 
-If you have a different path to your wolfSSL directory, run the script with the right path:
+If you have a different path to your wolfSSL directory, run the script with
+the right path:
+
 ```
-./generateOptions.sh ../files/wolfSSL
+./generateOptions.sh /path/to/wolfssl
 ```
 
 If wolfSSL is installed (i.e. `make install`'d to a custom `--prefix=...` path),
 pass the install prefix instead:
+
 ```
 ./generateOptions.sh /usr/local        # system install
 ./generateOptions.sh /opt/wolfssl-fips # custom prefix
 ```
 
-Every invocation regenerates `options.go` and rewrites the `#cgo` `CFLAGS` /
-`LDFLAGS` directives in every cgo-bearing file, so the whole tree agrees on one
-wolfSSL. An install prefix points them at that prefix; a source root or no
-argument points them at `/usr/local`.
+Every invocation regenerates `options.go`, writes a new options generation date,
+and rewrites the `#cgo` `CFLAGS` / `LDFLAGS` directives in every cgo-bearing
+file, so the whole tree agrees on one wolfSSL. An install prefix points the
+files at the given prefix. A source root or no argument will point the files
+at `/usr/local`.
 
 The prefix may contain only letters, digits and `/ _ . : + -`, since a `#cgo`
 directive cannot express a path containing spaces or shell metacharacters.
@@ -49,9 +60,10 @@ Anything else is rejected. On any failure the script exits 99 and leaves the
 tree as it found it.
 
 To install the wrapper module, run these commands:
+
 ```
 go get -u github.com/wolfssl/go-wolfssl
-go mod edit -replace github.com/wolfssl/go-wolfssl=<path to your go-wolfssl directory>
+go mod edit -replace github.com/wolfssl/go-wolfssl=</path/to/go-wolfssl>
 ```
 
 ## Running the TLS Server/Client example
@@ -59,20 +71,25 @@ go mod edit -replace github.com/wolfssl/go-wolfssl=<path to your go-wolfssl dire
 The example `.go` files are located in the `client` and `server` directories.
 
 To build the server, run:
+
 ```
 cd examples/server
 go build server.go
 ```
 
 To build the client, run:
+
 ```
 cd examples/client
 go build client.go
 ```
 
-**NOTE**: Make sure to run both the server and client from within their directories or change the certificate and key paths in the code so that the files are found.
+**NOTE**: Make sure to run both the server and client from within their
+directories or change the certificate and key paths in the code so that the
+files are found.
 
-See [examples/README.md](examples/README.md) for details on building/running the other examples.
+See [examples/README.md](examples/README.md) for details on building/running
+the other examples.
 
 ## Support
 
diff --git a/aes.go b/aes.go
index 830686f..6cc4766 100644
--- a/aes.go
+++ b/aes.go
@@ -20,6 +20,8 @@
 
 package wolfSSL
 
+// Options generation date:
+
 // #cgo CFLAGS: -g -Wall -I/usr/local/include
 // #cgo LDFLAGS: -L/usr/local/lib -lwolfssl -lm
 // #include <wolfssl/options.h>
diff --git a/examples/client/client-psk.go b/examples/client/client-psk.go
index 36a0bf3..f97248e 100644
--- a/examples/client/client-psk.go
+++ b/examples/client/client-psk.go
@@ -20,6 +20,8 @@
 
 package main
 
+// Options generation date:
+
 // #cgo CFLAGS: -g -Wall -I/usr/local/include
 //#include <string.h>
 //#include <wolfssl/options.h>
diff --git a/examples/server/server-psk.go b/examples/server/server-psk.go
index ccc6925..a0dd4f9 100644
--- a/examples/server/server-psk.go
+++ b/examples/server/server-psk.go
@@ -20,6 +20,8 @@
 
 package main
 
+// Options generation date:
+
 // #cgo CFLAGS: -g -Wall -I/usr/local/include
 //#include <string.h>
 //#include <wolfssl/options.h>
diff --git a/generateOptions.sh b/generateOptions.sh
index fb8c0c2..b3717ce 100755
--- a/generateOptions.sh
+++ b/generateOptions.sh
@@ -11,6 +11,7 @@
 OPTIONS_H="../wolfssl/wolfssl/options.h"
 DEFAULT_PREFIX="/usr/local"
 PREFIX=""
+DATE="$(date)"
 
 CGO_FILES="aes.go wolftls/conn.go wolfx509/certgen_wolfcrypt.go \
            examples/client/client-psk.go examples/server/server-psk.go"
@@ -90,12 +91,18 @@ esac
 trap on_exit EXIT
 trap 'exit 99' INT TERM
 
+# The 'Options generation date:' lines below are not decorative. These help
+# invalidate the cache generated by go (i.e., when wolfssl is rebuilt with the
+# same configure).
+
 rm -f options.go
-echo "package wolfSSL"                                       >> options.go
-echo ""                                                      >> options.go
-echo "// #cgo CFLAGS: -g -Wall -I$PREFIX/include"            >> options.go
-echo "// #cgo LDFLAGS: -L$PREFIX/lib -lwolfssl -lm"          >> options.go
-sed 's/^/\/\/ /' "$OPTIONS_H"                                >> options.go
+echo "package wolfSSL"                                      >> options.go
+echo ""                                                     >> options.go
+echo "// Options generation date: $DATE"                    >> options.go
+echo ""                                                     >> options.go
+echo "// #cgo CFLAGS: -g -Wall -I$PREFIX/include"           >> options.go
+echo "// #cgo LDFLAGS: -L$PREFIX/lib -lwolfssl -lm"         >> options.go
+sed 's/^/\/\/ /' "$OPTIONS_H"                               >> options.go
 if [ $? -ne 0 ]; then
     echo "Failed to generate options.go from $OPTIONS_H."
     exit 99
@@ -105,6 +112,7 @@ echo "options.go generated from $OPTIONS_H."
 # #cgo directives are package-scoped, so each cgo-using package carries one
 # declaration. Replace the whole directive line to prevent drift.
 sed -i.bak \
+    -e "s|^// Options generation date:.*|// Options generation date: $DATE|" \
     -e "s|^// #cgo CFLAGS:.*|// #cgo CFLAGS: -g -Wall -I$PREFIX/include|" \
     -e "s|^// #cgo LDFLAGS:.*|// #cgo LDFLAGS: -L$PREFIX/lib -lwolfssl -lm|" \
     $CGO_FILES
@@ -113,6 +121,11 @@ if [ $? -ne 0 ]; then
     exit 99
 fi
 
+for f in $CGO_FILES; do
+    grep -q -- 'Options generation date: ' "$f" || \
+        { echo "$f Options generation date not updated"; exit 99; }
+done
+
 SUCCESS=1
 
 echo "cgo paths pointed at $PREFIX."
diff --git a/wolftls/conn.go b/wolftls/conn.go
index 33e2a70..bb67a80 100644
--- a/wolftls/conn.go
+++ b/wolftls/conn.go
@@ -20,6 +20,8 @@
 
 package wolftls
 
+// Options generation date:
+
 // #cgo CFLAGS: -g -Wall -I/usr/local/include
 // #cgo LDFLAGS: -L/usr/local/lib -lwolfssl -lm
 import "C"
diff --git a/wolfx509/certgen_wolfcrypt.go b/wolfx509/certgen_wolfcrypt.go
index 5b5a0f0..af3fe5b 100644
--- a/wolfx509/certgen_wolfcrypt.go
+++ b/wolfx509/certgen_wolfcrypt.go
@@ -20,6 +20,8 @@
 
 package wolfx509
 
+// Options generation date:
+
 // #cgo CFLAGS: -g -Wall -I/usr/local/include
 // #cgo LDFLAGS: -L/usr/local/lib -lwolfssl -lm
 // #include <stdlib.h>