diff --git a/.github/workflows/ci-macos-compat.yml b/.github/workflows/ci-macos-compat.yml
index 9af8e9579128..513dd79f5bb1 100644
--- a/.github/workflows/ci-macos-compat.yml
+++ b/.github/workflows/ci-macos-compat.yml
@@ -99,6 +99,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
 
       - name: Capture Ghostty revision
         id: ghostty-revision
diff --git a/.github/workflows/cloud-vm-env-audit.yml b/.github/workflows/cloud-vm-env-audit.yml
index d05b8c325efc..f1b696d1cd0e 100644
--- a/.github/workflows/cloud-vm-env-audit.yml
+++ b/.github/workflows/cloud-vm-env-audit.yml
@@ -37,6 +37,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
 
       - name: Install dependencies
         working-directory: web
diff --git a/.github/workflows/cloud-vm-migrate.yml b/.github/workflows/cloud-vm-migrate.yml
index 0ed84f95bb9d..fd3292f3125c 100644
--- a/.github/workflows/cloud-vm-migrate.yml
+++ b/.github/workflows/cloud-vm-migrate.yml
@@ -42,6 +42,8 @@ jobs:
         run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Cloud VM migration preflight
@@ -69,6 +71,8 @@ jobs:
           ref: ${{ needs.preflight.outputs.source_sha }}
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Validate PlanetScale credentials
@@ -109,6 +113,8 @@ jobs:
           ref: ${{ needs.preflight.outputs.source_sha }}
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Validate PlanetScale credentials
diff --git a/.github/workflows/cloud-vm-smoke.yml b/.github/workflows/cloud-vm-smoke.yml
index efa67ecfd514..5edb4fb941a3 100644
--- a/.github/workflows/cloud-vm-smoke.yml
+++ b/.github/workflows/cloud-vm-smoke.yml
@@ -57,6 +57,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 9a07179438f3..379ed7e84c88 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -1021,6 +1021,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
 
       - name: Install build deps
         run: |
diff --git a/.github/workflows/perf-activation.yml b/.github/workflows/perf-activation.yml
index 76aa7f3257ba..99080e2c78a2 100644
--- a/.github/workflows/perf-activation.yml
+++ b/.github/workflows/perf-activation.yml
@@ -142,6 +142,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
 
       - name: Download pre-built GhosttyKit.xcframework
         env:
diff --git a/.github/workflows/presence.yml b/.github/workflows/presence.yml
index b863ee2124fa..025fdc05781d 100644
--- a/.github/workflows/presence.yml
+++ b/.github/workflows/presence.yml
@@ -47,6 +47,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
 
       # Wrangler requires Node >= 22; the Blacksmith ubuntu-2404 image ships
       # Node 20, so pin it explicitly instead of relying on the runner's
@@ -87,6 +89,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
 
       # Wrangler requires Node >= 22; Blacksmith ubuntu-2404 ships Node 20.
       - name: Setup Node
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7f69219456b9..b3bd71211738 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -226,6 +226,8 @@ jobs:
       - name: Setup Bun
         if: steps.guard_release_assets.outputs.skip_all != 'true'
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
 
       - name: Install build deps
         if: steps.guard_release_assets.outputs.skip_all != 'true'
diff --git a/.github/workflows/reload-build.yml b/.github/workflows/reload-build.yml
index f447a09f5492..2c36b36d22aa 100644
--- a/.github/workflows/reload-build.yml
+++ b/.github/workflows/reload-build.yml
@@ -130,6 +130,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
 
       # The macOS app build compiles the bundled cmux-cua (Rust) in a copy-
       # resources phase via scripts/build-cmux-cua.sh, so the runner needs a
diff --git a/.github/workflows/tmux-corpus.yml b/.github/workflows/tmux-corpus.yml
index 321b55ebb493..fee7709b2782 100644
--- a/.github/workflows/tmux-corpus.yml
+++ b/.github/workflows/tmux-corpus.yml
@@ -48,6 +48,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
 
       - name: Cache GhosttyKit.xcframework
         id: cache-ghosttykit
diff --git a/tests/test_ci_change_areas.py b/tests/test_ci_change_areas.py
index e7466bf9fb27..2e9a1a487f8c 100644
--- a/tests/test_ci_change_areas.py
+++ b/tests/test_ci_change_areas.py
@@ -1264,6 +1264,27 @@ def test_web_workflow_pins_every_bun_setup_version() -> None:
         assert '          bun-version: "1.3.14"' in setup_tail
 
 
+def test_every_setup_bun_step_declares_a_version() -> None:
+    workflows = ROOT / ".github" / "workflows"
+    action = "oven-sh/setup-bun@"
+    found = 0
+
+    for workflow_path in sorted(workflows.glob("*.yml")):
+        lines = workflow_path.read_text(encoding="utf-8").splitlines()
+        for index, line in enumerate(lines):
+            if action not in line:
+                continue
+            found += 1
+            tail = lines[index + 1:index + 7]
+            assert any("bun-version:" in candidate for candidate in tail), (
+                workflow_path.relative_to(ROOT),
+                index + 1,
+                "setup-bun must declare an explicit bun-version",
+            )
+
+    assert found >= 20, "setup-bun inventory unexpectedly disappeared"
+
+
 def test_web_typecheck_retries_native_tsgo_abort() -> None:
     script = workflow_job_step_script("web-typecheck", "Typecheck", WEB_WORKFLOW)