diff --git a/CHANGELOG.md b/CHANGELOG.md
index 706dc5f..c62145d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,18 @@
 
 Reconstructed from git history for everything up to `v0.1.1`; kept by hand from there.
 
+## unreleased
+
+- **fix**: bump httpz to `ede9a78`, which serializes `detachHttp` with the state/list
+  transition it races. `swapList` guarded (remove -> publish `_state` -> insert) with the
+  per-connection `_mut`; `detachHttp` made the same list decision from the same `_state`
+  without taking it, so the reactor could remove a conn from a list it was not in yet,
+  clobber that list's `head`/`tail`, and then free a `Conn` the list still referenced.
+  Recycling that storage into a websocket produced the `access of union field 'http' while
+  field 'retired' is active` panic that SIGABRT'd this PDS on 2026-08-18. Reported and
+  reproduced upstream; the fix moves `setState(.handover)` inside the lock and ships a
+  deterministic regression test.
+
 ## 0.2.0 — 2026-08-18
 
 Two months of work since `v0.1.1` (2026-06-18). Headlines:
diff --git a/build.zig.zon b/build.zig.zon
index 7dfb9d2..6a95f17 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -17,8 +17,8 @@
             .hash = "webauthn-0.0.1--JitMv-LAACZoE0TF1Y4poG3EUvlk8q_qbz8NbLMPXAI",
         },
         .httpz = .{
-            .url = "https://tangled.org/zzstoatzz.io/http.zig/archive/c1005c2.tar.gz",
-            .hash = "httpz-0.0.0-PNVzrElyCQB2uaTmJqX2eLOeCyk2cLz00BtKV0BXeP8w",
+            .url = "https://tangled.org/zzstoatzz.io/http.zig/archive/ede9a78.tar.gz",
+            .hash = "httpz-0.0.0-PNVzrIqECQCNhEpVfJxPZnYONE3dllYGQdXPcq2Lnx8v",
         },
         .websocket = .{
             .url = "https://tangled.org/zzstoatzz.io/websocket.zig/archive/v0.1.11.tar.gz",