diff --git a/.github/workflows/build-engine.yml b/.github/workflows/build-engine.yml
index 8c5d50e..cad271f 100644
--- a/.github/workflows/build-engine.yml
+++ b/.github/workflows/build-engine.yml
@@ -6,11 +6,11 @@ on:
       telemt_commit:
         description: 'Telemt commit hash to build from'
         required: true
-        default: '3bd5637'
+        default: '504cafb'
       version_tag:
         description: 'Version tag (e.g. 3.4.8-10c9bcd)'
         required: true
-        default: '3.4.11-3bd5637'
+        default: '3.4.15-504cafb'
 
 env:
   REGISTRY: ghcr.io
diff --git a/mtproxymax.sh b/mtproxymax.sh
index a8efec6..27bba17 100644
--- a/mtproxymax.sh
+++ b/mtproxymax.sh
@@ -26,8 +26,8 @@ REPLICATION_FILE="${INSTALL_DIR}/replication.conf"
 REPLICATION_SSH_DIR="${INSTALL_DIR}/.ssh"
 CONTAINER_NAME="mtproxymax"
 DOCKER_IMAGE_BASE="mtproxymax-telemt"
-TELEMT_MIN_VERSION="3.4.11"
-TELEMT_COMMIT="3bd5637"  # Pinned: v3.4.11 — persistent quota, per-user deny lists, TLS cert budget, security hardening
+TELEMT_MIN_VERSION="3.4.15"
+TELEMT_COMMIT="504cafb"  # Pinned: v3.4.15 — MSS tuning
 GITHUB_REPO="SamNet-dev/MTProxyMax"
 REGISTRY_IMAGE="ghcr.io/samnet-dev/mtproxymax-telemt"