diff --git a/app/src/main/java/org/thoughtcrime/securesms/contacts/sync/ContactDiscoveryRefreshV2.kt b/app/src/main/java/org/thoughtcrime/securesms/contacts/sync/ContactDiscoveryRefreshV2.kt
index efcc309e2f..4980ea0caf 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/contacts/sync/ContactDiscoveryRefreshV2.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/contacts/sync/ContactDiscoveryRefreshV2.kt
@@ -96,7 +96,8 @@ object ContactDiscoveryRefreshV2 {
         SignalDatabase.recipients.getAllServiceIdProfileKeyPairs(),
         Optional.empty(),
         10_000,
-        AppDependencies.libsignalNetwork
+        AppDependencies.libsignalNetwork,
+        RemoteConfig.libsignalRouteBasedCDSILookup
       ) {
         Log.i(TAG, "Ignoring token for one-off lookup.")
       }
@@ -160,7 +161,8 @@ object ContactDiscoveryRefreshV2 {
         SignalDatabase.recipients.getAllServiceIdProfileKeyPairs(),
         Optional.ofNullable(token),
         timeoutMs,
-        AppDependencies.libsignalNetwork
+        AppDependencies.libsignalNetwork,
+        RemoteConfig.libsignalRouteBasedCDSILookup
       ) { tokenToSave ->
         stopwatch.split("network-pre-token")
         if (!isPartialRefresh) {
diff --git a/app/src/main/java/org/thoughtcrime/securesms/util/RemoteConfig.kt b/app/src/main/java/org/thoughtcrime/securesms/util/RemoteConfig.kt
index c452792c0c..97236a85b9 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/util/RemoteConfig.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/util/RemoteConfig.kt
@@ -1134,5 +1134,12 @@ object RemoteConfig {
     hotSwappable = true
   )
 
+  /** Whether or not libsignal-net's CDSI lookups use the new route-based internals or the old ones */
+  val libsignalRouteBasedCDSILookup: Boolean by remoteBoolean(
+    key = "android.libsignal.libsignalRouteBasedCDSILookup",
+    defaultValue = true,
+    hotSwappable = true
+  )
+
   // endregion
 }
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 9df715de12..6e9d3256dc 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -13,7 +13,7 @@ androidx-window = "1.3.0"
 glide = "4.15.1"
 gradle = "8.7.3"
 kotlin = "2.1.0"
-libsignal-client = "0.66.2"
+libsignal-client = "0.67.0"
 mp4parser = "1.9.39"
 android-gradle-plugin = "8.7.2"
 accompanist = "0.28.0"
diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml
index 853a2e155a..0cbdda5437 100644
--- a/gradle/verification-metadata.xml
+++ b/gradle/verification-metadata.xml
@@ -6604,20 +6604,20 @@ https://docs.gradle.org/current/userguide/dependency_verification.html
             <sha256 value="6eb4422e8a618b3b76cb2096a3619d251f9e27989dc68307a1e5414c3710f2d1" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.signal" name="libsignal-android" version="0.66.2">
-         <artifact name="libsignal-android-0.66.2.aar">
-            <sha256 value="1a3053ed5cc1d9a3408abaf27926a058925c2b1b5a80ac1dd29f6f1465beaf33" origin="Generated by Gradle"/>
+      <component group="org.signal" name="libsignal-android" version="0.67.0">
+         <artifact name="libsignal-android-0.67.0.aar">
+            <sha256 value="b2547a4edae8274d0e90d52b5c2880ecd8d24386b44ac0365753c4aff8ad6942" origin="Generated by Gradle"/>
          </artifact>
-         <artifact name="libsignal-android-0.66.2.module">
-            <sha256 value="775f06f61145232e219faf47fa74d0c6eb7490211eaf78c62fd360f0d4a8c9af" origin="Generated by Gradle"/>
+         <artifact name="libsignal-android-0.67.0.module">
+            <sha256 value="b25c8043f8f78bbc942a7ae62d8a74e24c38ed2928a52a43abe2f2462c22f1a8" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.signal" name="libsignal-client" version="0.66.2">
-         <artifact name="libsignal-client-0.66.2.jar">
-            <sha256 value="c69628b306573257a216c007f6f3458cb2c6f05058cbf4eec24cfd3d3544511e" origin="Generated by Gradle"/>
+      <component group="org.signal" name="libsignal-client" version="0.67.0">
+         <artifact name="libsignal-client-0.67.0.jar">
+            <sha256 value="2d9f416971b09e1ab704ae01198db3ce8831f23f8fb2c3331b83db21d8816b83" origin="Generated by Gradle"/>
          </artifact>
-         <artifact name="libsignal-client-0.66.2.module">
-            <sha256 value="573cbc4651e244c5480fa78b574551fedb62bd1d337599aab9df0d6cfcc94bc2" origin="Generated by Gradle"/>
+         <artifact name="libsignal-client-0.67.0.module">
+            <sha256 value="3fc85b3fd68d6c6148f200de751f474601323986159b78145cc088288b597d16" origin="Generated by Gradle"/>
          </artifact>
       </component>
       <component group="org.signal" name="ringrtc-android" version="2.50.0">
diff --git a/libsignal-service/src/main/java/org/whispersystems/signalservice/api/SignalServiceAccountManager.java b/libsignal-service/src/main/java/org/whispersystems/signalservice/api/SignalServiceAccountManager.java
index 3cb1b3ecd9..3df7ca0468 100644
--- a/libsignal-service/src/main/java/org/whispersystems/signalservice/api/SignalServiceAccountManager.java
+++ b/libsignal-service/src/main/java/org/whispersystems/signalservice/api/SignalServiceAccountManager.java
@@ -221,11 +221,12 @@ public class SignalServiceAccountManager {
                                                            Optional<byte[]> token,
                                                            Long timeoutMs,
                                                            @Nonnull Network libsignalNetwork,
+                                                           boolean useLibsignalRouteBasedCDSIConnectionLogic,
                                                            Consumer<byte[]> tokenSaver)
       throws IOException
   {
     CdsiAuthResponse                                auth    = pushServiceSocket.getCdsiAuth();
-    CdsiV2Service                                   service = new CdsiV2Service(libsignalNetwork);
+    CdsiV2Service                                   service = new CdsiV2Service(libsignalNetwork, useLibsignalRouteBasedCDSIConnectionLogic);
     CdsiV2Service.Request                           request = new CdsiV2Service.Request(previousE164s, newE164s, serviceIds, token);
     Single<ServiceResponse<CdsiV2Service.Response>> single  = service.getRegisteredUsers(auth.getUsername(), auth.getPassword(), request, tokenSaver);
 
diff --git a/libsignal-service/src/main/java/org/whispersystems/signalservice/api/services/CdsiV2Service.java b/libsignal-service/src/main/java/org/whispersystems/signalservice/api/services/CdsiV2Service.java
index ad1f32b891..cf393c860b 100644
--- a/libsignal-service/src/main/java/org/whispersystems/signalservice/api/services/CdsiV2Service.java
+++ b/libsignal-service/src/main/java/org/whispersystems/signalservice/api/services/CdsiV2Service.java
@@ -53,10 +53,10 @@ public final class CdsiV2Service {
 
   private final CdsiRequestHandler cdsiRequestHandler;
 
-  public CdsiV2Service(@Nonnull Network network) {
+  public CdsiV2Service(@Nonnull Network network, boolean useLibsignalRouteBasedCDSIConnectionLogic) {
     this.cdsiRequestHandler = (username, password, request, tokenSaver) -> {
       try {
-        Future<CdsiLookupResponse> cdsiRequest = network.cdsiLookup(username, password, buildLibsignalRequest(request), tokenSaver);
+        Future<CdsiLookupResponse> cdsiRequest = network.cdsiLookup(username, password, buildLibsignalRequest(request), tokenSaver, useLibsignalRouteBasedCDSIConnectionLogic);
         return Single.fromFuture(cdsiRequest)
                      .onErrorResumeNext((Throwable err) -> {
                        if (err instanceof ExecutionException && err.getCause() != null) {