diff --git a/.github/workflows/build-pikepdf.yml b/.github/workflows/build-pikepdf.yml
index c2a851638f1..33530dd0b46 100644
--- a/.github/workflows/build-pikepdf.yml
+++ b/.github/workflows/build-pikepdf.yml
@@ -64,6 +64,16 @@ jobs:
           ref: v${{ env.PIKEPDF_VERSION }}
           persist-credentials: false
 
+      - name: Read upstream qpdf pin
+        run: |
+          python3 - >> "$GITHUB_ENV" <<'EOF'
+          import tomllib
+          with open("pyproject.toml", "rb") as f:
+              env = tomllib.load(f)["tool"]["cibuildwheel"]["environment"]
+          for key in ("QPDF_MIN_VERSION", "QPDF_VERSION", "QPDF_PATTERN"):
+              print(f"{key}={env[key]}")
+          EOF
+
       - name: Build wheels
         uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
         with:
@@ -73,11 +83,12 @@ jobs:
           CIBW_MANYLINUX_RISCV64_IMAGE: ${{ env.MANYLINUX_RISCV64_IMAGE }}
           # CIBW_ENVIRONMENT replaces, not merges, upstream's [tool.cibuildwheel.environment]
           # table, so QPDF_* (consumed by before-all's build-scripts/*.bash) must be repeated
-          # alongside our registry (CLAUDE.md gotcha 107).
+          # alongside our registry (CLAUDE.md gotcha 107); they are read from the checked-out
+          # pyproject.toml so each pikepdf version builds against the qpdf it pins.
           CIBW_ENVIRONMENT: >-
-            QPDF_MIN_VERSION=12.3.2
-            QPDF_VERSION=12.3.2
-            QPDF_PATTERN=https://github.com/qpdf/qpdf/releases/download/vVERSION/qpdf-VERSION.tar.gz
+            QPDF_MIN_VERSION=${{ env.QPDF_MIN_VERSION }}
+            QPDF_VERSION=${{ env.QPDF_VERSION }}
+            QPDF_PATTERN=${{ env.QPDF_PATTERN }}
             PIP_EXTRA_INDEX_URL=https://pypi.riseproject.dev/simple/
           # hypothesis switched its build backend to maturin; newer releases have no
           # riscv64 wheel anywhere, and maturin's rustup auto-install does not support
diff --git a/docs/packages/pikepdf.yaml b/docs/packages/pikepdf.yaml
index ba487dcb9b5..9db82920bff 100644
--- a/docs/packages/pikepdf.yaml
+++ b/docs/packages/pikepdf.yaml
@@ -32,3 +32,4 @@ versions:
   - filename: pikepdf-10.13.0.post1-cp314-cp314t-manylinux_2_39_riscv64.whl
     sha256: 915d7e2af38b9b565419340912c41d84f5a2f084e9a731fddab9aa3e1bcd942d
     requires-python: '>=3.10'
+- version: 10.14.0