diff --git a/src/Analyser/ExprHandler/PreDecHandler.php b/src/Analyser/ExprHandler/PreDecHandler.php
index efaf6a7b44d..b7bc7515ffa 100644
--- a/src/Analyser/ExprHandler/PreDecHandler.php
+++ b/src/Analyser/ExprHandler/PreDecHandler.php
@@ -90,7 +90,11 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 			$assignedScope,
 			beforeScope: $scope,
 			expr: $expr,
-			variableFlow: VariableFlow::sequence($varResult->getVariableFlow(), $valueFlowWrite !== null && $context->isValueConsumed() ? VariableFlow::inputs($valueFlowWrite->getId(), $context->getValueFlowTarget() !== null ? $context->getValueFlowTarget()->getId() : null) : null, VariableFlowBuilder::targetWrite($expr->var, VariableWrite::KIND_PRE_DEC, $assignedScope, $storage)),
+			variableFlow: VariableFlow::sequence(
+				$varResult->getVariableFlow(),
+				VariableFlowBuilder::targetWrite($expr->var, VariableWrite::KIND_PRE_DEC, $assignedScope, $storage),
+				$valueFlowWrite !== null && $context->isValueConsumed() ? VariableFlowBuilder::targetRead($expr->var, $storage, true, $context->getValueFlowTarget() !== null ? $context->getValueFlowTarget()->getId() : null) : null,
+			),
 			hasYield: $varResult->hasYield(),
 			isAlwaysTerminating: $varResult->isAlwaysTerminating(),
 			throwPoints: $varResult->getThrowPoints(),
diff --git a/src/Analyser/ExprHandler/PreIncHandler.php b/src/Analyser/ExprHandler/PreIncHandler.php
index 9d7e02bf780..854627dc21c 100644
--- a/src/Analyser/ExprHandler/PreIncHandler.php
+++ b/src/Analyser/ExprHandler/PreIncHandler.php
@@ -90,7 +90,11 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 			$assignedScope,
 			beforeScope: $scope,
 			expr: $expr,
-			variableFlow: VariableFlow::sequence($varResult->getVariableFlow(), $valueFlowWrite !== null && $context->isValueConsumed() ? VariableFlow::inputs($valueFlowWrite->getId(), $context->getValueFlowTarget() !== null ? $context->getValueFlowTarget()->getId() : null) : null, VariableFlowBuilder::targetWrite($expr->var, VariableWrite::KIND_PRE_INC, $assignedScope, $storage)),
+			variableFlow: VariableFlow::sequence(
+				$varResult->getVariableFlow(),
+				VariableFlowBuilder::targetWrite($expr->var, VariableWrite::KIND_PRE_INC, $assignedScope, $storage),
+				$valueFlowWrite !== null && $context->isValueConsumed() ? VariableFlowBuilder::targetRead($expr->var, $storage, true, $context->getValueFlowTarget() !== null ? $context->getValueFlowTarget()->getId() : null) : null,
+			),
 			hasYield: $varResult->hasYield(),
 			isAlwaysTerminating: $varResult->isAlwaysTerminating(),
 			throwPoints: $varResult->getThrowPoints(),
diff --git a/src/Turbo/TurboExtensionEnabler.php b/src/Turbo/TurboExtensionEnabler.php
index 03b1e80d4d7..b61ebc4e69a 100644
--- a/src/Turbo/TurboExtensionEnabler.php
+++ b/src/Turbo/TurboExtensionEnabler.php
@@ -33,7 +33,7 @@
 final class TurboExtensionEnabler
 {
 
-	public const EXPECTED_EXTENSION_VERSION = '12acf37';
+	public const EXPECTED_EXTENSION_VERSION = '9f63407';
 
 	private static bool $active = false;
 
diff --git a/tests/PHPStan/Rules/DeadCode/UnusedVariableRuleTest.php b/tests/PHPStan/Rules/DeadCode/UnusedVariableRuleTest.php
index a16a5965174..2ceca6991c7 100644
--- a/tests/PHPStan/Rules/DeadCode/UnusedVariableRuleTest.php
+++ b/tests/PHPStan/Rules/DeadCode/UnusedVariableRuleTest.php
@@ -18,6 +18,11 @@ protected function getRule(): Rule
 		return new UnusedVariableRule(self::getContainer()->getByType(ExprPrinter::class));
 	}
 
+	public function testBug15411(): void
+	{
+		$this->analyse([__DIR__ . '/data/bug-15411.php'], []);
+	}
+
 	public function testThrowableCatchAfterDocumentedException(): void
 	{
 		$this->analyse([__DIR__ . '/data/unused-variable-throwable-catch.php'], []);
diff --git a/tests/PHPStan/Rules/DeadCode/data/bug-15411.php b/tests/PHPStan/Rules/DeadCode/data/bug-15411.php
new file mode 100644
index 00000000000..380edf7633a
--- /dev/null
+++ b/tests/PHPStan/Rules/DeadCode/data/bug-15411.php
@@ -0,0 +1,41 @@
+<?php declare(strict_types = 1);
+
+namespace Bug15411;
+
+function nextCookieValue(int $count): string
+{
+	return (string) ++$count;
+}
+
+echo nextCookieValue(1);
+
+function previousCookieValue(int $count): string
+{
+	return (string) --$count;
+}
+
+echo previousCookieValue(1);
+
+function nextAssignedValue(int $count): int
+{
+	$value = ++$count;
+	return $value;
+}
+
+function previousAssignedValue(int $count): int
+{
+	$value = --$count;
+	return $value;
+}
+
+/** @param array{count: int} $counts */
+function nextOffsetValue(array $counts): int
+{
+	return ++$counts['count'];
+}
+
+/** @param array{count: int} $counts */
+function previousOffsetValue(array $counts): int
+{
+	return --$counts['count'];
+}
diff --git a/turbo-ext/src/PreDecHandler.cpp b/turbo-ext/src/PreDecHandler.cpp
index f29ed90129a..a2e343fa37c 100644
--- a/turbo-ext/src/PreDecHandler.cpp
+++ b/turbo-ext/src/PreDecHandler.cpp
@@ -102,7 +102,7 @@ class PreDecHandler
 		zv::Val assignedScope = ptse::scopeOf(assignResult.raw());
 		if (UNEXPECTED(assignedScope.isUndef())) return zv::Val();
 
-		zv::Val variableFlow = ptse::incDecFlow(child.variableFlow.raw(), valueFlowWrite.raw(), context, var, pt_pdh_kind, assignedScope.raw(), storage);
+		zv::Val variableFlow = ptse::incDecFlow(child.variableFlow.raw(), valueFlowWrite.raw(), context, var, pt_pdh_kind, assignedScope.raw(), storage, true);
 		if (UNEXPECTED(variableFlow.isUndef())) return zv::Val();
 		zv::Val dependenciesHold;
 		zval *dependencies = pt_expression_result_dependencies(varResult.raw(), dependenciesHold);
diff --git a/turbo-ext/src/PreIncHandler.cpp b/turbo-ext/src/PreIncHandler.cpp
index e5c5e34f15e..10da8ae5905 100644
--- a/turbo-ext/src/PreIncHandler.cpp
+++ b/turbo-ext/src/PreIncHandler.cpp
@@ -102,7 +102,7 @@ class PreIncHandler
 		zv::Val assignedScope = ptse::scopeOf(assignResult.raw());
 		if (UNEXPECTED(assignedScope.isUndef())) return zv::Val();
 
-		zv::Val variableFlow = ptse::incDecFlow(child.variableFlow.raw(), valueFlowWrite.raw(), context, var, pt_pih_kind, assignedScope.raw(), storage);
+		zv::Val variableFlow = ptse::incDecFlow(child.variableFlow.raw(), valueFlowWrite.raw(), context, var, pt_pih_kind, assignedScope.raw(), storage, true);
 		if (UNEXPECTED(variableFlow.isUndef())) return zv::Val();
 		zv::Val dependenciesHold;
 		zval *dependencies = pt_expression_result_dependencies(varResult.raw(), dependenciesHold);
diff --git a/turbo-ext/src/SimpleExprHandlers.h b/turbo-ext/src/SimpleExprHandlers.h
index cdde333e601..8187b935699 100644
--- a/turbo-ext/src/SimpleExprHandlers.h
+++ b/turbo-ext/src/SimpleExprHandlers.h
@@ -132,11 +132,9 @@ inline zv::Val valueFlowContext(zval *context, zval *valueFlowWrite)
 	return pt_expression_context_enter_value_flow(deep.raw(), valueFlowWrite, false);
 }
 
-/* VariableFlow::sequence($varResult->getVariableFlow(), $valueFlowWrite !==
- * null && $context->isValueConsumed() ? VariableFlow::inputs($valueFlowWrite->getId(),
- * $context->getValueFlowTarget() !== null ? $context->getValueFlowTarget()->getId() : null)
- * : null, VariableFlowBuilder::targetWrite($var, $kind, $assignedScope, $storage)) */
-inline zv::Val incDecFlow(zval *varFlow, zval *valueFlowWrite, zval *context, zval *var, zend_long kind, zval *assignedScope, zval *storage)
+/* Post-inc/dec consumes the inputs of the write; pre-inc/dec consumes the
+ * newly written value, so its target read must follow the target write. */
+inline zv::Val incDecFlow(zval *varFlow, zval *valueFlowWrite, zval *context, zval *var, zend_long kind, zval *assignedScope, zval *storage, bool readsNewValue = false)
 {
 	zv::Val inputsFlow = zv::Val::null();
 	if (Z_TYPE_P(valueFlowWrite) != IS_NULL) {
@@ -154,13 +152,15 @@ inline zv::Val incDecFlow(zval *varFlow, zval *valueFlowWrite, zval *context, zv
 				targetId = variableWriteId(target.raw());
 				if (UNEXPECTED(targetId.isUndef())) return zv::Val();
 			}
-			inputsFlow = pt_variable_flow_inputs(zval_get_long(writeId.raw()), targetId.raw());
+			inputsFlow = readsNewValue
+				? pt_variable_flow_builder_target_read(var, storage, true, targetId.raw())
+				: pt_variable_flow_inputs(zval_get_long(writeId.raw()), targetId.raw());
 			if (UNEXPECTED(inputsFlow.isUndef())) return zv::Val();
 		}
 	}
 	zv::Val targetWriteFlow = pt_variable_flow_builder_target_write(var, kind, assignedScope, storage, NULL);
 	if (UNEXPECTED(targetWriteFlow.isUndef())) return zv::Val();
-	zv::Args flows{varFlow, inputsFlow.raw(), targetWriteFlow.raw()};
+	zv::Args flows{varFlow, readsNewValue ? targetWriteFlow.raw() : inputsFlow.raw(), readsNewValue ? inputsFlow.raw() : targetWriteFlow.raw()};
 	return pt_variable_flow_sequence(3, flows);
 }