diff --git a/.github/workflows/flutter-build.yml b/.github/workflows/flutter-build.yml
index 8f1853f67..970928785 100644
--- a/.github/workflows/flutter-build.yml
+++ b/.github/workflows/flutter-build.yml
@@ -1726,7 +1726,7 @@ jobs:
               export DRMTAP_REPO="https://github.com/rustdesk-org/libdrmtap"
               export DRMTAP_REF="main"
               # Literal (not overridable by an inherited env var) so the ref/commit pair is immutable in CI.
-              export DRMTAP_SHA="c9cf0938f3b10a3d4a9eeb9c6f97aaa1606c6b4a"
+              export DRMTAP_SHA="816766dedaba3140c613712ce97aa2614e8899e7"
               # Guard: accept only an exact vX.Y.Z tag OR the literal `main`, so a random/loose branch
               # is still rejected; the DRMTAP_SHA check below is the real anchor (it fails the build if
               # `main` -- or a tag -- resolves to anything other than the pinned immutable commit).
diff --git a/build.py b/build.py
index 3efeaf795..b1b3e72c0 100755
--- a/build.py
+++ b/build.py
@@ -349,8 +349,8 @@ LIBDRMTAP_REF = os.environ.get('DRMTAP_REF', 'main')
 # The immutable commit the ref must resolve to. `git clone --branch` follows a mutable ref (a branch
 # even more than a tag), so verifying this after clone catches a moved/compromised ref swapping the
 # .so. Keep in sync with LIBDRMTAP_REF on every bump (override via DRMTAP_SHA together with DRMTAP_REF
-# for a local fork). This commit is libdrmtap v0.4.13.
-LIBDRMTAP_SHA = os.environ.get('DRMTAP_SHA', 'c9cf0938f3b10a3d4a9eeb9c6f97aaa1606c6b4a')
+# for a local fork). This commit is libdrmtap v0.4.14.
+LIBDRMTAP_SHA = os.environ.get('DRMTAP_SHA', '816766dedaba3140c613712ce97aa2614e8899e7')
 
 
 def _single_real_so(paths, where):
diff --git a/libs/scrap/Cargo.toml b/libs/scrap/Cargo.toml
index 24a9a4a7a..a7e614b28 100644
--- a/libs/scrap/Cargo.toml
+++ b/libs/scrap/Cargo.toml
@@ -14,7 +14,8 @@ wayland = ["gstreamer", "gstreamer-app", "gstreamer-video", "dbus", "tracing", "
 # `drm` is a pure runtime-dlopen backend: rustdesk loads `libdrmtap.so.0` at runtime (`drmtap_dl.rs`)
 # and NEVER link-time links it, so the graceful PipeWire fallback when the .so or EGL is absent is
 # preserved and the drm build pulls in no libdrm/seccomp/cap/EGL link-time deps. The .so is version
-# pinned by build.py's `DRMTAP_REF = v0.4.13` (an exact release tag, not `main`). We deliberately do
+# pinned by build.py's `DRMTAP_SHA` to the libdrmtap v0.4.14 release commit (`DRMTAP_REF` is `main`,
+# and the exact commit is verified after clone). We deliberately do
 # NOT depend on the `libdrmtap-sys` crate: its build.rs statically compiles the whole libdrmtap C tree
 # and a CAP_SYS_ADMIN helper and emits `-ldrm -lseccomp -lcap`, which would defeat the dlopen model.
 drm = []