diff --git a/.changeset/bump_libwebrtc_a545de4.md b/.changeset/bump_libwebrtc_a545de4.md
new file mode 100644
index 000000000..59ff8166f
--- /dev/null
+++ b/.changeset/bump_libwebrtc_a545de4.md
@@ -0,0 +1,10 @@
+---
+libwebrtc: patch
+livekit: patch
+livekit-capture: patch
+livekit-ffi: patch
+webrtc-sys: patch
+webrtc-sys-build: patch
+---
+
+fix: bump libwebrtc to webrtc-a545de4 to drop roots that trust the compromised eMudhra intermediates. The new build refreshes the TURN/TLS anchors compiled into `rtc_base/ssl_roots.h`, which no longer include `AAA Certificate Services`, the root that cross-signs the eight eMudhra intermediate CAs whose keys were disclosed on 2026-10-20.
diff --git a/webrtc-sys/build/src/lib.rs b/webrtc-sys/build/src/lib.rs
index 586b66751..4dc7d89a2 100644
--- a/webrtc-sys/build/src/lib.rs
+++ b/webrtc-sys/build/src/lib.rs
@@ -28,7 +28,7 @@ use regex::Regex;
 use reqwest::StatusCode;
 
 pub const SCRATH_PATH: &str = "livekit_webrtc";
-pub const WEBRTC_TAG: &str = "webrtc-89d790b";
+pub const WEBRTC_TAG: &str = "webrtc-a545de4";
 pub const IGNORE_DEFINES: [&str; 2] = ["CR_CLANG_REVISION", "CR_XCODE_VERSION"];
 
 pub fn target_os() -> String {