diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index f3fda0da..8af4b024 100644
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -125,6 +125,14 @@ jobs:
             libcurl4-openssl-dev \
             libwayland-dev libdecor-0-dev
 
+      # The libwebrtc artifact ships a hermetic libc++ built from LLVM trunk.
+      # Distro clang (14 on Ubuntu 22.04, 18 on 24.04) cannot compile its
+      # headers; the submodule script installs LLVM 21 and exports CC/CXX.
+      - name: Install clang for libwebrtc
+        if: runner.os == 'Linux'
+        shell: bash
+        run: client-sdk-rust/.github/scripts/install-clang.sh
+
       - name: Install deps (macOS)
         if: runner.os == 'macOS'
         run: |
@@ -191,8 +199,9 @@ jobs:
         run: |
           echo "CXXFLAGS=-Wno-deprecated-declarations" >> "$GITHUB_ENV"
           echo "CFLAGS=-Wno-deprecated-declarations" >> "$GITHUB_ENV"
-          LLVM_VERSION=$(llvm-config --version | cut -d. -f1)
-          echo "LIBCLANG_PATH=/usr/lib/llvm-${LLVM_VERSION}/lib" >> "$GITHUB_ENV"
+          LLVM_ROOT="$(dirname "${CXX}")/.."
+          test -f "${LLVM_ROOT}/lib/libclang.so"
+          echo "LIBCLANG_PATH=${LLVM_ROOT}/lib" >> "$GITHUB_ENV"
 
       # ---------- Build ----------
       - name: Build (Unix)
diff --git a/.github/workflows/make-release.yml b/.github/workflows/make-release.yml
index 45bb289d..de810ff7 100644
--- a/.github/workflows/make-release.yml
+++ b/.github/workflows/make-release.yml
@@ -125,6 +125,14 @@ jobs:
             libcurl4-openssl-dev \
             libwayland-dev libdecor-0-dev
 
+      # The libwebrtc artifact ships a hermetic libc++ built from LLVM trunk.
+      # Distro clang cannot compile its headers; install the same LLVM version
+      # used by the Linux build and test workflows.
+      - name: Install clang for libwebrtc
+        if: runner.os == 'Linux'
+        shell: bash
+        run: client-sdk-rust/.github/scripts/install-clang.sh
+
       - name: Install deps (macOS)
         if: runner.os == 'macOS'
         run: |
@@ -185,10 +193,11 @@ jobs:
       - name: Set Linux build environment
         if: runner.os == 'Linux'
         run: |
-          echo "CXXFLAGS=-Wno-deprecated-declarations" >> $GITHUB_ENV
-          echo "CFLAGS=-Wno-deprecated-declarations" >> $GITHUB_ENV
-          LLVM_VERSION=$(llvm-config --version | cut -d. -f1)
-          echo "LIBCLANG_PATH=/usr/lib/llvm-${LLVM_VERSION}/lib" >> $GITHUB_ENV
+          echo "CXXFLAGS=-Wno-deprecated-declarations" >> "$GITHUB_ENV"
+          echo "CFLAGS=-Wno-deprecated-declarations" >> "$GITHUB_ENV"
+          LLVM_ROOT="$(dirname "${CXX}")/.."
+          test -f "${LLVM_ROOT}/lib/libclang.so"
+          echo "LIBCLANG_PATH=${LLVM_ROOT}/lib" >> "$GITHUB_ENV"
 
       # ---------- Build + Bundle (Unix) ----------
       - name: Build and Bundle (Unix)
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 92f04bf5..398aa0f0 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -229,6 +229,14 @@ jobs:
             libwayland-dev libdecor-0-dev \
             gdb jq
 
+      # The libwebrtc artifact ships a hermetic libc++ built from LLVM trunk.
+      # Distro clang (14 on Ubuntu 22.04, 18 on 24.04) cannot compile its
+      # headers; the submodule script installs LLVM 21 and exports CC/CXX.
+      - name: Install clang for libwebrtc
+        if: runner.os == 'Linux'
+        shell: bash
+        run: client-sdk-rust/.github/scripts/install-clang.sh
+
       - name: Install deps (macOS)
         if: runner.os == 'macOS'
         run: |
@@ -291,8 +299,9 @@ jobs:
         run: |
           echo "CXXFLAGS=-Wno-deprecated-declarations" >> "$GITHUB_ENV"
           echo "CFLAGS=-Wno-deprecated-declarations" >> "$GITHUB_ENV"
-          LLVM_VERSION=$(llvm-config --version | cut -d. -f1)
-          echo "LIBCLANG_PATH=/usr/lib/llvm-${LLVM_VERSION}/lib" >> "$GITHUB_ENV"
+          LLVM_ROOT="$(dirname "${CXX}")/.."
+          test -f "${LLVM_ROOT}/lib/libclang.so"
+          echo "LIBCLANG_PATH=${LLVM_ROOT}/lib" >> "$GITHUB_ENV"
 
       - name: Configure Unix crash diagnostics
         if: runner.os != 'Windows'
@@ -511,6 +520,12 @@ jobs:
             libwayland-dev libdecor-0-dev
           pip install --break-system-packages gcovr
 
+      # The coverage build compiles the Rust FFI too, so it needs the same
+      # compiler floor as the normal Linux build/test matrices.
+      - name: Install clang for libwebrtc
+        shell: bash
+        run: client-sdk-rust/.github/scripts/install-clang.sh
+
       # ---------- Rust toolchain ----------
       - name: Install Rust (stable)
         uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
@@ -544,10 +559,12 @@ jobs:
       # ---------- Build environment setup ----------
       - name: Set build environment
         run: |
-          LLVM_VERSION=$(llvm-config --version | cut -d. -f1)
-          echo "LIBCLANG_PATH=/usr/lib/llvm-${LLVM_VERSION}/lib" >> "$GITHUB_ENV"
-          GCC_VER=$(gcc -dumpversion | cut -d. -f1)
-          echo "GCOV_EXECUTABLE=gcov-${GCC_VER}" >> "$GITHUB_ENV"
+          LLVM_ROOT="$(dirname "${CXX}")/.."
+          test -f "${LLVM_ROOT}/lib/libclang.so"
+          LLVM_COV="${LLVM_ROOT}/bin/llvm-cov"
+          test -x "${LLVM_COV}"
+          echo "LIBCLANG_PATH=${LLVM_ROOT}/lib" >> "$GITHUB_ENV"
+          echo "GCOV_EXECUTABLE=${LLVM_COV} gcov" >> "$GITHUB_ENV"
 
       # ---------- Configure with upstream preset + coverage flag overrides ----------
       - name: Configure (linux-debug-tests preset + coverage flags)
diff --git a/client-sdk-rust b/client-sdk-rust
index 1a477bc4..2d9f01ab 160000
--- a/client-sdk-rust
+++ b/client-sdk-rust
@@ -1 +1 @@
-Subproject commit 1a477bc422c6890537b3bcdb017f0ac094d49661
+Subproject commit 2d9f01ab1e933a86a8a5c53805ee29ee58b9be1b