diff --git a/Cargo.toml b/Cargo.toml
index fc53aa354..e8a722802 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -60,8 +60,8 @@ tokio-native-tls = "0.3"
 # Fork of v0.26.2: upstream's WebSocketStream exposes get_config but no set_config, so a
 # message cap lowered before authorization could never be lifted again. One commit on top of
 # the tag; pinned by rev, not branch, because a fork branch can be rewritten under the lockfile.
-tokio-tungstenite = { git = "https://github.com/rustdesk-org/tokio-tungstenite", rev = "9c320de8e7c546cb654b017b7f4cbb4a5cc09cd9", version = "0.26", features = ["native-tls", "rustls-tls-native-roots", "rustls-tls-webpki-roots"] }
-tungstenite = { version = "0.26", features = ["native-tls", "rustls-tls-native-roots", "rustls-tls-webpki-roots"] }
+tokio-tungstenite = { git = "https://github.com/rustdesk-org/tokio-tungstenite", rev = "c241b11b03de4881faf1ecd2fe6e867c92f3013b", version = "0.29", features = ["native-tls", "rustls-tls-native-roots", "rustls-tls-webpki-roots"] }
+tungstenite = { version = "0.29", features = ["native-tls", "rustls-tls-native-roots", "rustls-tls-webpki-roots"] }
 rustls-platform-verifier = "0.6"
 rustls-pki-types = "1.11"
 rustls-native-certs = "0.8"
diff --git a/src/websocket.rs b/src/websocket.rs
index 2e38c90ff..b2901e322 100644
--- a/src/websocket.rs
+++ b/src/websocket.rs
@@ -216,9 +216,10 @@ impl WsFramedStream {
         self.encrypt = None;
     }
 
-    /// Both bounds, not just the message one: tungstenite reserves the whole declared payload of a
-    /// frame as soon as it passes `max_frame_size` (`protocol/frame/mod.rs`), so that is what keeps
-    /// a frame header from buying an allocation, while `max_message_size` bounds reassembly.
+    /// Both bounds, not just the message one: `max_frame_size` refuses an oversized frame on its
+    /// header, before any of it is buffered, while `max_message_size` bounds reassembly across a
+    /// fragmented one. What a header on its own can allocate is `read_buffer_size`, the patched
+    /// fork growing the read buffer a chunk at a time rather than to the length a frame declares.
     #[inline]
     pub fn set_max_packet_length(&mut self, n: usize) {
         self.stream.set_config(|c| {