diff --git a/CHANGELOG.md b/CHANGELOG.md
index a9a2dc5..4b61a33 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # changelog
 
+## 0.3.4
+
+- **fix**: bump websocket.zig to v0.1.4 — best-effort `setsockopt` on connection sockets. when a peer resets or another thread closes a socket mid-flight, the RCVTIMEO/SNDTIMEO/TCP_NODELAY calls hit `EBADF`/`ENOTSOCK`, which `std.posix.setsockopt` maps to `unreachable` ("always a race condition"), panicking the worker thread (SIGSEGV); the prior `catch` could not swallow it. also folds in v0.1.2 (defer `InvalidConnection`/`InvalidUpgrade` past the handshake body-completeness check) and v0.1.3 (close socket in nonblocking `cleanupConn`, fixing an FD leak).
+
 ## 0.3.3
 
 - **feat**: `jwt.verifyJose(alg, message, signature, public_key)` — lenient ES256/ES256K verification for JOSE/JWT contexts (OAuth client assertions, DPoP), accepting high-S signatures per RFC 7515.
diff --git a/build.zig.zon b/build.zig.zon
index 0345cec..2131b46 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -1,12 +1,12 @@
 .{
     .name = .zat,
-    .version = "0.3.3",
+    .version = "0.3.4",
     .fingerprint = 0x8da9db57ee82fbe4,
     .minimum_zig_version = "0.16.0-dev.3070+b22eb176b",
     .dependencies = .{
         .websocket = .{
-            .url = "https://github.com/zzstoatzz/websocket.zig/archive/refs/tags/v0.1.1.tar.gz",
-            .hash = "websocket-0.1.1-ZPISdRI8BAAGcBRyGf0a4qlxvFDdqNKWUsuVQYh1Ih62",
+            .url = "https://github.com/zzstoatzz/websocket.zig/archive/refs/tags/v0.1.4.tar.gz",
+            .hash = "websocket-0.1.2-ZPISdXFPBAB4F0i5uz0NkdgHU4J0PWrGFnjgYKzaBwmJ",
         },
         .@"atproto-interop-tests" = .{
             .url = "https://github.com/bluesky-social/atproto-interop-tests/archive/35bb5638ab1e5ce71fb88a0c95953fc557ef1925.tar.gz",