diff --git a/.github/actions/cloud-setup-test-env/action.yml b/.github/actions/cloud-setup-test-env/action.yml
index 86f0bd0f85da4..6571da991b46f 100644
--- a/.github/actions/cloud-setup-test-env/action.yml
+++ b/.github/actions/cloud-setup-test-env/action.yml
@@ -5,7 +5,11 @@ inputs:
   bun-version:
     description: Bun version to install (pinned to avoid GitHub API rate-limit flakes).
     required: false
-    default: "canary"
+    # pinned: floating canary hangs `bun install` on hosted CI runners and
+    # writes lockfileVersion 2 which breaks --frozen-lockfile (#11184/#9454).
+    # Cloud Tests + cloud-e2e call this action without an override, so this
+    # default is what actually runs on those (queue-starved) lanes.
+    default: "1.3.14"
   setup-db:
     description: Start PGlite TCP server and run migrations.
     required: false
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8850f2f1c275f..455d6c97aaecb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -22,7 +22,10 @@ concurrency:
 
 env:
   CI: "true"
-  BUN_VERSION: "canary"
+  # pinned: floating canary hangs `bun install` on hosted CI runners and writes
+  # lockfileVersion 2 which breaks --frozen-lockfile (#11184/#9454). This env
+  # drives the integration/unit/lint/cloud-live-e2e jobs' bun-version input.
+  BUN_VERSION: "1.3.14"
   NODE_VERSION: "24.15.0"
   NODE_NO_WARNINGS: "1"
   NODE_OPTIONS: "--max-old-space-size=8192"