diff --git a/Dockerfile b/Dockerfile
index 7e9a0d5..ea6db4a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,8 +26,8 @@ RUN case "${TARGETARCH}" in \
 # Pinned to the latest upstream release. Bump WISP_VERSION and WISP_COMMIT to
 # update (see UPDATING.md). WISP_COMMIT is the immutable commit the tag points
 # to; the guard below fails the build if the tag is ever re-pointed.
-ARG WISP_VERSION=v0.5.5
-ARG WISP_COMMIT=76a3261369ff4a2b5dedb778e8b1d42184800ea4
+ARG WISP_VERSION=v0.5.14
+ARG WISP_COMMIT=40ec89eb5439c80a3b3508b5f52fcfd64d76cc9f
 RUN git clone --branch ${WISP_VERSION} --depth 1 https://github.com/privkeyio/wisp.git /src && \
     HEAD_SHA="$(git -C /src rev-parse HEAD)" && \
     if [ "${HEAD_SHA}" != "${WISP_COMMIT}" ]; then \
diff --git a/startos/versions/current.ts b/startos/versions/current.ts
index 0046d41..3fc4836 100644
--- a/startos/versions/current.ts
+++ b/startos/versions/current.ts
@@ -1,10 +1,10 @@
 import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
 
 export const current = VersionInfo.of({
-  version: '0.5.5:0',
+  version: '0.5.14:0',
   releaseNotes: {
     en_US:
-      'Updates wisp to v0.5.5. No behavior change from v0.5.4: wisp now builds against the upstream http.zig and websocket.zig libraries instead of temporary forks, since all of its fixes have been merged upstream. Carries forward every prior fix: the inbound-worker crash fix, crash-safe storage, stable Spider upstream connections, no per-IP cap behind the StartOS proxy, and the diagnosable (ReleaseSafe) build.',
+      'Updates wisp to v0.5.14. Queries are now bounded in how many stored entries they may scan, so a selective filter matching fewer events than its limit no longer walks the entire database. This fixes severe CPU and major page-fault load on large databases. The new query_scan_multiplier setting (default 20, 0 to disable) controls the bound. Carries forward every prior fix.',
   },
   migrations: {
     up: async ({ effects }) => {},