diff --git a/CHANGELOG.md b/CHANGELOG.md
index 854be15..1efd5d3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # changelog
 
+## 0.3.18
+
+- **fix**: bump websocket.zig to `73429df` — the client set socket timeouts through `std.posix.setsockopt`, which maps `BADF`/`NOTSOCK`/`INVAL` to `unreachable` ("always a race condition"). those are reachable on a *connection* socket: an upstream that resets around the handshake aborted the whole process from inside `FirehoseClient.connectAndRead`, and `unreachable` cannot be caught by the reconnect loop. found downstream in stream, where a full test suite aborted roughly one run in seven; clean across 27 runs after. client-side counterpart of the same fix websocket.zig already applied server-side.
+
 ## 0.3.17
 
 - **fix**: align websocket.zig at 0.1.10, preserving a single Zig 0.16 module graph for consumers that use the new stable, port-free peer-IP API directly.
diff --git a/build.zig.zon b/build.zig.zon
index 071d19d..b3c87e9 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -1,12 +1,12 @@
 .{
     .name = .zat,
-    .version = "0.3.17",
+    .version = "0.3.18",
     .fingerprint = 0x8da9db57ee82fbe4,
     .minimum_zig_version = "0.16.0-dev.3070+b22eb176b",
     .dependencies = .{
         .websocket = .{
-            .url = "https://github.com/zzstoatzz/websocket.zig/archive/11e0f5c.tar.gz",
-            .hash = "websocket-0.1.10-ZPISdVMlBQDzeHNBIGKCjm231WcBfspGZgAUjboi4pGY",
+            .url = "https://github.com/zzstoatzz/websocket.zig/archive/73429df.tar.gz",
+            .hash = "websocket-0.1.10-ZPISdUowBQAXIl_X9VpZozIxBLVf_o5wYjOMMdobrXF5",
         },
         .@"atproto-interop-tests" = .{
             .url = "https://github.com/bluesky-social/atproto-interop-tests/archive/35bb5638ab1e5ce71fb88a0c95953fc557ef1925.tar.gz",