diff --git a/_dl.sh b/_dl.sh
index 8560ff6a9..8b4340dbd 100755
--- a/_dl.sh
+++ b/_dl.sh
@@ -108,9 +108,11 @@ cat <<EOF
   },
   {
     "name": "ngtcp2",
-    "url": "https://github.com/ngtcp2/ngtcp2/releases/download/v{ver}/ngtcp2-{ver}.tar.xz",
+    "url": "https://github.com/ngtcp2/ngtcp2/releases/download/v{ver}/ngtcp2-{ver}.tar.bz2",
+    "sig": "https://github.com/ngtcp2/ngtcp2/releases/download/v{ver}/ngtcp2-{ver}.tar.bz2.asc",
     "redir": "redir",
-    "tag": ".+"
+    "tag": ".+",
+    "keys": "516B622918D15C478AB1EA3A5339A2BE82E07DEC"
   },
   {
     "name": "wolfssl",
diff --git a/_versions.sh b/_versions.sh
index 65b43219d..08a94d107 100755
--- a/_versions.sh
+++ b/_versions.sh
@@ -38,8 +38,8 @@ export NGHTTP2_VER_='1.60.0'
 export NGHTTP2_HASH=625d6c3da1d9ca4fd643a638256431ae68fd1901653b2a61a245eea7b261bf4e
 export NGHTTP3_VER_='1.2.0'
 export NGHTTP3_HASH=d2e216bae7bd7362f850922e4237a5caa204853b3594b22adccab4c1e1c1d1aa
-export NGTCP2_VER_='1.3.0'
-export NGTCP2_HASH=c3e386674103feedfedcc711190affcdec1c682af8a850469ecf1714d28c139b
+export NGTCP2_VER_='1.4.0'
+export NGTCP2_HASH=70b647144fe258c18763a87130750d0b5ec61ba5cb9a2cd2eb6eef70108594c3
 export WOLFSSL_VER_='5.6.6'
 export WOLFSSL_HASH=3d2ca672d41c2c2fa667885a80d6fa03c3e91f0f4f72f87aef2bc947e8c87237
 export MBEDTLS_VER_='3.5.2'