diff --git a/os-image/ubuntu/22.04-redroid-16.0-gms-h264/Dockerfile b/os-image/ubuntu/22.04-redroid-16.0-gms-h264/Dockerfile
index 6ddf5282..95d69e6c 100644
--- a/os-image/ubuntu/22.04-redroid-16.0-gms-h264/Dockerfile
+++ b/os-image/ubuntu/22.04-redroid-16.0-gms-h264/Dockerfile
@@ -107,10 +107,10 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
 #     Tight/JPEG/ZRLE/Hextile/Raw framebuffer on the same port. There is no X
 #     server or framebuffer scraping hop. ---
 ARG SCRCPY_RFB_REPO=cocoonstack/scrcpy-rfb
-ARG SCRCPY_RFB_TAG=master
+ARG SCRCPY_RFB_TAG=master-827baf531
 # Bump to adopt a new scrcpy-rfb release; kept out of the top ARG block because an
 # in-scope ARG joins every later cache key, so a bump there rebuilds the whole image.
-ARG SCRCPY_RFB_COMMIT=9bdf6ed2b50953589ef153c18f087bcaafc429d9
+ARG SCRCPY_RFB_COMMIT=827baf531715d6b86482c7ac6c63fd31030c58aa
 RUN APT_OPTS='-o Acquire::Retries=10 -o Acquire::http::Timeout=120' && \
     if [ "$TARGETARCH" = arm64 ]; then sed 's|http://ports.ubuntu.com/ubuntu-ports|http://mirrors.mit.edu/ubuntu-ports|g' /etc/apt/sources.list > /etc/apt/sources.list.d/mit-ports.list; fi && \
     apt_ensure() { for i in 1 2 3 4 5 6 7 8; do apt-get $APT_OPTS update && apt-get $APT_OPTS install -y --no-install-recommends "$@" && return 0; echo "apt retry $i for: $*" >&2; sleep 15; done; return 1; } && \
diff --git a/os-image/ubuntu/22.04-redroid-16.0-gms-h264/README.md b/os-image/ubuntu/22.04-redroid-16.0-gms-h264/README.md
index 12f80ac7..7f0944cb 100644
--- a/os-image/ubuntu/22.04-redroid-16.0-gms-h264/README.md
+++ b/os-image/ubuntu/22.04-redroid-16.0-gms-h264/README.md
@@ -183,9 +183,10 @@ docker buildx build --load --platform linux/amd64 -t local/android:16.0-gms-h264
 `build.sh` is a bake-only worker: it verifies ReDroid is a single physical layer,
 bakes the restart-primed container into a vfs Docker store, and hardlink-dedups +
 tars it to `docker-data-<arch>.tar`. The VM Dockerfile resolves the scrcpy-rfb
-release itself (no build-arg from the shared step): `SCRCPY_RFB_COMMIT` pins the
-commit the `master` release must be at, and both `Dockerfile` and
-`remoteview.Dockerfile` have to be bumped together to adopt a newer one.
+release itself (no build-arg from the shared step): `SCRCPY_RFB_TAG` names an
+immutable `master-<sha>` release, `SCRCPY_RFB_COMMIT` pins the commit it must be at,
+and both `Dockerfile` and `remoteview.Dockerfile` have to be bumped together to
+adopt a newer one.
 
 Export a Cocoon-importable rootfs (per arch):
 
diff --git a/os-image/ubuntu/22.04-redroid-16.0-gms-h264/remoteview.Dockerfile b/os-image/ubuntu/22.04-redroid-16.0-gms-h264/remoteview.Dockerfile
index 9053a638..4159b8f0 100644
--- a/os-image/ubuntu/22.04-redroid-16.0-gms-h264/remoteview.Dockerfile
+++ b/os-image/ubuntu/22.04-redroid-16.0-gms-h264/remoteview.Dockerfile
@@ -5,8 +5,8 @@ FROM ubuntu:22.04
 ENV DEBIAN_FRONTEND=noninteractive
 ARG TARGETARCH
 ARG SCRCPY_RFB_REPO=cocoonstack/scrcpy-rfb
-ARG SCRCPY_RFB_TAG=master
-ARG SCRCPY_RFB_COMMIT=9bdf6ed2b50953589ef153c18f087bcaafc429d9
+ARG SCRCPY_RFB_TAG=master-827baf531
+ARG SCRCPY_RFB_COMMIT=827baf531715d6b86482c7ac6c63fd31030c58aa
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     adb curl ca-certificates libjpeg-turbo8 zlib1g && \