diff --git a/Dockerfile b/Dockerfile
index 7e9a0d5..ea6db4a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,8 +26,8 @@ RUN case "${TARGETARCH}" in \
 # Pinned to the latest upstream release. Bump WISP_VERSION and WISP_COMMIT to
 # update (see UPDATING.md). WISP_COMMIT is the immutable commit the tag points
 # to; the guard below fails the build if the tag is ever re-pointed.
-ARG WISP_VERSION=v0.5.5
-ARG WISP_COMMIT=76a3261369ff4a2b5dedb778e8b1d42184800ea4
+ARG WISP_VERSION=v0.5.14
+ARG WISP_COMMIT=40ec89eb5439c80a3b3508b5f52fcfd64d76cc9f
 RUN git clone --branch ${WISP_VERSION} --depth 1 https://github.com/privkeyio/wisp.git /src && \
     HEAD_SHA="$(git -C /src rev-parse HEAD)" && \
     if [ "${HEAD_SHA}" != "${WISP_COMMIT}" ]; then \
diff --git a/README.md b/README.md
index be98cae..ac2d3c7 100644
--- a/README.md
+++ b/README.md
@@ -117,7 +117,7 @@ Require NIP-42 authentication (to connect and/or to publish), restrict connectio
 
 | Check | Method | Display | Message |
 |-------|--------|---------|---------|
-| Relay | Port listening (7777) | "Relay" | "The relay is ready and accepting connections" / "The relay is not responding" |
+| Relay | HTTP GET on `http://127.0.0.1:7777/` (5s timeout) | "Relay" | "The relay is ready and accepting connections" / "The relay is not responding" |
 
 ---
 
diff --git a/startos/main.ts b/startos/main.ts
index e27d79c..2460d13 100644
--- a/startos/main.ts
+++ b/startos/main.ts
@@ -32,8 +32,14 @@ export const main = sdk.setupMain(async ({ effects }) => {
     exec: { command: ['wisp', 'relay', configPath] },
     ready: {
       display: i18n('Relay'),
+      // An HTTP fetch, not just a port-listening check: a wedged relay keeps
+      // its listen socket bound (the kernel still completes handshakes) while
+      // serving nothing, which checkPortListening reads as healthy. Fetching
+      // GET / requires wisp to actually respond, so an accept-stalled relay
+      // fails the check instead of appearing up.
       fn: () =>
-        sdk.healthCheck.checkPortListening(effects, relayPort, {
+        sdk.healthCheck.checkWebUrl(effects, `http://127.0.0.1:${relayPort}/`, {
+          timeout: 5000,
           successMessage: i18n('The relay is ready and accepting connections'),
           errorMessage: i18n('The relay is not responding'),
         }),
diff --git a/startos/versions/current.ts b/startos/versions/current.ts
index 0046d41..c362da9 100644
--- a/startos/versions/current.ts
+++ b/startos/versions/current.ts
@@ -1,10 +1,10 @@
 import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
 
 export const current = VersionInfo.of({
-  version: '0.5.5:0',
+  version: '0.5.14:2',
   releaseNotes: {
     en_US:
-      'Updates wisp to v0.5.5. No behavior change from v0.5.4: wisp now builds against the upstream http.zig and websocket.zig libraries instead of temporary forks, since all of its fixes have been merged upstream. Carries forward every prior fix: the inbound-worker crash fix, crash-safe storage, stable Spider upstream connections, no per-IP cap behind the StartOS proxy, and the diagnosable (ReleaseSafe) build.',
+      'Updates wisp to v0.5.14. Queries are now bounded in how many stored entries they may scan, so a selective filter matching fewer events than its limit no longer walks the entire database. This fixes severe CPU and major page-fault load on large databases. The new query_scan_multiplier setting (default 20, 0 to disable) controls the bound. The health check now performs an HTTP request so an unresponsive relay is reported as down. Carries forward every prior fix.',
   },
   migrations: {
     up: async ({ effects }) => {},