diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 33ab060a1..bdf1f78bc 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -69,6 +69,8 @@ jobs:
       matrix:
         video: [x11, wayland]
     runs-on: ubuntu-latest
+    # A window test that hangs fails the job here, rather than an hour later.
+    timeout-minutes: 20
     container: ubuntu:26.04
     steps:
       - name: Install tools, lavapipe and a headless display
@@ -79,7 +81,8 @@ jobs:
             mesa-vulkan-drivers libvulkan1 vulkan-tools \
             xvfb xauth weston \
             libx11-6 libxext6 libxrandr2 libxcursor1 libxi6 libxfixes3 libxss1 libxtst6 \
-            libwayland-client0 libwayland-cursor0 libwayland-egl1 libxkbcommon0 libdecor-0-0
+            libwayland-client0 libwayland-cursor0 libwayland-egl1 libxkbcommon0 libdecor-0-0 \
+            libegl1 libegl-mesa0 libgles2
           dpkg-query -W libxkbcommon0 libwayland-client0 mesa-vulkan-drivers weston
           ls /usr/share/vulkan/icd.d
           # The manifest's name moves between Mesa releases (lvp_icd.json, lvp_icd.x86_64.json)
@@ -127,13 +130,16 @@ jobs:
   # SDL sends from libwayland's own trace (WAYLAND_DEBUG), so it needs a real compositor: weston's
   # headless backend, with its default desktop shell, which maximizes and fullscreens. At output
   # scale 1 and 2, as the insets are in window coordinates whatever the scale. lavapipe presents
-  # the frames that map the windows. Ubuntu 26.04 for the same libxkbcommon reason as above.
+  # the frames that map the windows; Mesa's EGL (llvmpipe) draws for the test that makes a window
+  # again for an OpenGL ES renderer. Ubuntu 26.04 for the same libxkbcommon reason as above.
   test-fizzy-wayland-insets:
     strategy:
       fail-fast: false
       matrix:
         scale: [1, 2]
     runs-on: ubuntu-latest
+    # A window test that hangs fails the job here, rather than an hour later.
+    timeout-minutes: 20
     container: ubuntu:26.04
     steps:
       - name: Install tools, lavapipe and weston
@@ -142,8 +148,9 @@ jobs:
           DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
             ca-certificates git xz-utils \
             mesa-vulkan-drivers libvulkan1 weston \
-            libwayland-client0 libwayland-cursor0 libwayland-egl1 libxkbcommon0
-          dpkg-query -W libwayland-client0 mesa-vulkan-drivers weston
+            libwayland-client0 libwayland-cursor0 libwayland-egl1 libxkbcommon0 \
+            libegl1 libegl-mesa0 libgles2
+          dpkg-query -W libwayland-client0 mesa-vulkan-drivers libegl-mesa0 weston
           echo "VK_DRIVER_FILES=$(ls /usr/share/vulkan/icd.d/lvp_icd*.json | head -n 1)" >> "$GITHUB_ENV"
 
       - name: Checkout
diff --git a/build.zig.zon b/build.zig.zon
index 98b1aa4af..58c852415 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -5,13 +5,13 @@
     .minimum_zig_version = "0.16.0",
     .dependencies = .{
         // fizzyedit/SDL: release-3.4.16 with fizzy's patches on top. TEST PIN: branch
-        // `test/fizzy-wayland-insets`, `fizzy-3.4` (tag `fizzy-3.4.16-7`) plus the test suite for
-        // patch 6, untagged until it is reviewed and moved onto `fizzy-3.4`. Pinned by commit.
-        // `.version` is still the SDL release it is based on: `build.zig` reads it for the
-        // library's SO version.
+        // `wayland/frame-insets-fixes`, `fizzy-3.4` (tag `fizzy-3.4.16-8`) plus the fixes to patch 6
+        // from fizzyedit/fizzy#280 (C2b) and their tests, untagged until it is reviewed and moved onto
+        // `fizzy-3.4`. Pinned by commit. `.version` is still the SDL release it is based on:
+        // `build.zig` reads it for the library's SO version.
         .sdl = .{
-            .url = "https://github.com/fizzyedit/SDL/archive/a518aaf9e3b915330c5ae80771efbbca5523d29e.tar.gz",
-            .hash = "N-V-__8AAMhY-QJGBfy_DcJQIubyngZlFT5ebaIR5IU4MxCS",
+            .url = "https://github.com/fizzyedit/SDL/archive/011a2dc5a28e9191426138f6f76b07559862be9d.tar.gz",
+            .hash = "N-V-__8AAMaj-QLJ5JN7pQJDileI_owA6_YLRwYo85SyzNim",
             .version = "3.4.16",
         },
         .dbus = .{