@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: package.json
 
 
@@ -13,7 +13,7 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v6
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: package.json
 
 
@@ -12,7 +12,7 @@
 
 ### Internal
 
-- **One Bun version for CI, releases and local builds** — The root `package.json` pins `packageManager` to `[email protected]`, and the CI and publish workflows read it with `bun-version-file: package.json` instead of installing `latest`. 0.5.1 shipped Bun 1.4.3 while CI and local builds could use other versions; a local 1.3.10 build of the same commit was about 85 ms slower to first response and used about 85 MB more RSS. The pre-push hook and build scripts now require Bun 1.4.3 or a later 1.x.
+- **One Bun version for CI, releases and local builds** — The root `package.json` pins `packageManager` to `[email protected]`, and the CI and publish workflows read it with `bun-version-file: package.json` instead of installing `latest`. 0.5.1 shipped Bun 1.4.3 while CI and local builds could use other versions; a local 1.3.10 build of the same commit was about 85 ms slower to first response and used about 85 MB more RSS. The pre-push hook and `@aictrl/script` (used by the build) check the local Bun against `packageManager`, so they now require Bun 1.4.3 or a later 1.x. The `bun-node` container image no longer has its own default `BUN_VERSION` and takes the `packageManager` version from its build script.
 
 ## 0.5.1 (2026-10-18)
 
 
@@ -41,13 +41,19 @@
 
 The compiled binary embeds the Bun runtime that built it, so the Bun version is
 part of the release. The root `package.json` `packageManager` field is the only
-place it is set: CI and the publish workflow read it through
-`bun-version-file: package.json`, and the pre-push hook and build scripts check
-the local Bun against it.
+place it is set:
+
+- CI and the publish workflow read it through `bun-version-file: package.json`.
+- `.husky/pre-push` and `@aictrl/script` (imported by
+  `packages/cli/script/build.ts`) reject a local Bun outside `^<version>`.
+- `packages/containers/script/build.ts` passes it to the `bun-node` image as
+  `BUN_VERSION`; the Dockerfile has no default.
 
 Bump it deliberately, in its own PR, never as a side effect of another change.
-Before merging the bump, re-measure time to first response and RSS against the
-previous Bun. Bun 1.3.10 to 1.4.3 alone moved them by about 85 ms and 85 MB.
+Before merging the bump, build the binary with the old and the new Bun and
+compare time to first response and RSS: run a one-turn `aictrl run` against a
+stub model in a fresh, CPU- and memory-limited container, several times each.
+Moving from Bun 1.3.10 to 1.4.3 alone changed them by about 85 ms and 85 MB.
 
 ## 0.5.1 candidate
 
 
@@ -0,0 +1,33 @@
+import { expect, test } from "bun:test"
+import path from "path"
+
+// The compiled binary embeds the Bun that built it, so every toolchain entry
+// point must take the version from the root package.json `packageManager`.
+const root = path.resolve(import.meta.dir, "../../../..")
+const read = (file: string) => Bun.file(path.join(root, file)).text()
+
+test("packageManager pins an exact Bun version", async () => {
+  const pkg = JSON.parse(await read("package.json"))
+  expect(pkg.packageManager).toMatch(/^bun@\d+\.\d+\.\d+$/)
+})
+
+test.each([".github/workflows/ci.yml", ".github/workflows/publish.yml"])(
+  "%s installs Bun from package.json",
+  async (file) => {
+    const workflow = Bun.YAML.parse(await read(file)) as {
+      jobs: Record<string, { steps: { uses?: string; with?: Record<string, string> }[] }>
+    }
+    const setups = Object.values(workflow.jobs)
+      .flatMap((job) => job.steps)
+      .filter((step) => step.uses?.startsWith("oven-sh/setup-bun@"))
+    expect(setups.length).toBeGreaterThan(0)
+    for (const step of setups) {
+      expect(step.with).toEqual({ "bun-version-file": "package.json" })
+    }
+  },
+)
+
+test("bun-node image has no Bun version of its own", async () => {
+  const dockerfile = await read("packages/containers/bun-node/Dockerfile")
+  expect(dockerfile).toMatch(/^ARG BUN_VERSION$/m)
+})
@@ -4,7 +4,9 @@ FROM ${REGISTRY}/build/base:24.04
 SHELL ["/bin/bash", "-lc"]
 
 ARG NODE_VERSION=24.4.0
-ARG BUN_VERSION=1.4.3
+# No default: packages/containers/script/build.ts passes the root package.json
+# packageManager version, the single source of the Bun version.
+ARG BUN_VERSION
 
 ENV BUN_INSTALL=/opt/bun
 ENV PATH=/opt/bun/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
@@ -18,6 +20,7 @@ RUN set -euo pipefail; \
   corepack enable
 
 RUN set -euo pipefail; \
+  : "${BUN_VERSION:?pass --build-arg BUN_VERSION (packages/containers/script/build.ts reads it from package.json packageManager)}"; \
   curl -fsSL https://bun.sh/install | bash -s -- "bun-v${BUN_VERSION}"; \
   bun --version; \
   node --version; \