diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3d362178d..face64517 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,8 +26,6 @@ jobs:
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.11
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -45,8 +43,6 @@ jobs:
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.11
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -63,8 +59,6 @@ jobs:
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.11
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d4c334049..fa36cf0a7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,8 +19,6 @@ jobs:
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.11
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -100,8 +98,6 @@ jobs:
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.11
 
       - name: Install dependencies (all platforms' native packages)
         run: bun install --frozen-lockfile --os='*' --cpu='*'
@@ -145,8 +141,6 @@ jobs:
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.11
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
diff --git a/Dockerfile b/Dockerfile
index cdb73b77f..15766106f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,10 @@
 # syntax=docker/dockerfile:1
 
-FROM oven/bun:1.3.11 AS build
+# The one place the Bun version lives for the image; CI reads it from
+# package.json "packageManager" instead, so bumping Bun is two lines.
+ARG BUN_VERSION=1.4.2
+
+FROM oven/bun:${BUN_VERSION} AS build
 WORKDIR /app
 # vendor/pixel-art-icons is a `file:` dep — `bun install` needs it on disk to
 # resolve the dependency, so copy it alongside the manifest before installing.
@@ -10,13 +14,13 @@ RUN bun install --frozen-lockfile
 COPY . .
 RUN bun run build
 
-FROM oven/bun:1.3.11 AS production-deps
+FROM oven/bun:${BUN_VERSION} AS production-deps
 WORKDIR /app
 COPY package.json bun.lock ./
 COPY vendor ./vendor
 RUN bun install --frozen-lockfile --production
 
-FROM oven/bun:1.3.11 AS runtime
+FROM oven/bun:${BUN_VERSION} AS runtime
 WORKDIR /app
 
 ARG INSTATIC_VERSION=dev
diff --git a/package.json b/package.json
index 9fee8320d..624591d9a 100644
--- a/package.json
+++ b/package.json
@@ -3,8 +3,9 @@
   "private": true,
   "version": "0.0.18",
   "engines": {
-    "bun": ">=1.3.0 <1.4.0"
+    "bun": ">=1.4.0 <1.5.0"
   },
+  "packageManager": "bun@1.4.2",
   "description": "Self-hosted CMS with an integrated visual editor.",
   "author": "David Babinec",
   "license": "MIT",
diff --git a/scripts/sync-plugin-bootstrap.ts b/scripts/sync-plugin-bootstrap.ts
index 86f9949e3..fc62e5772 100644
--- a/scripts/sync-plugin-bootstrap.ts
+++ b/scripts/sync-plugin-bootstrap.ts
@@ -28,7 +28,7 @@
  * Bundler determinism: `Bun.build` output is stable within a Bun minor but is
  * NOT guaranteed bit-identical across minors, so a Bun upgrade can legitimately
  * change the bytes. The expected Bun is pinned by `engines.bun` in package.json
- * (`>=1.3.0 <1.4.0`) and by the `oven/bun:1.3` base image in the Dockerfile. On
+ * (`>=1.4.0 <1.5.0`) and by the `oven/bun:1.4` base image in the Dockerfile. On
  * a deliberate Bun-minor bump, regenerate (`bun run bootstrap:sync`) in the same
  * change so the gate fails only on real source drift, never on a routine
  * upgrade.
diff --git a/src/__tests__/server/dockerConfig.test.ts b/src/__tests__/server/dockerConfig.test.ts
index 0a6645aba..52c7460a1 100644
--- a/src/__tests__/server/dockerConfig.test.ts
+++ b/src/__tests__/server/dockerConfig.test.ts
@@ -22,9 +22,10 @@ describe('self-host docker config', () => {
   it('defines a production Docker image that builds assets before runtime startup', () => {
     const dockerfile = readFileSync('Dockerfile', 'utf8')
 
-    expect(dockerfile).toContain('FROM oven/bun:1.3.11 AS build')
+    expect(dockerfile).toContain('ARG BUN_VERSION=1.4.2')
+    expect(dockerfile).toContain('FROM oven/bun:${BUN_VERSION} AS build')
     expect(dockerfile).toContain('RUN bun run build')
-    expect(dockerfile).toContain('FROM oven/bun:1.3.11 AS runtime')
+    expect(dockerfile).toContain('FROM oven/bun:${BUN_VERSION} AS runtime')
     expect(dockerfile).toContain('ARG INSTATIC_VERSION=dev')
     expect(dockerfile).toContain('LABEL org.opencontainers.image.version="${INSTATIC_VERSION}"')
     expect(dockerfile).toContain('CMD ["bun", "run", "server/index.ts"]')