diff --git a/.bun-version b/.bun-version
new file mode 100644
index 00000000..7962dcfd
--- /dev/null
+++ b/.bun-version
@@ -0,0 +1 @@
+1.3.13
diff --git a/.github/workflows/pr-check.yml b/.github/workflows/pr-check.yml
index 0aa74cc4..87956b14 100644
--- a/.github/workflows/pr-check.yml
+++ b/.github/workflows/pr-check.yml
@@ -28,7 +28,8 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          # Pinned (bump .bun-version on purpose): `latest` changes under us.
+          bun-version-file: .bun-version
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -79,7 +80,8 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          # Pinned (bump .bun-version on purpose): `latest` changes under us.
+          bun-version-file: .bun-version
 
       # Web consumes @codeoid/core + @codeoid/protocol via file: deps. When
       # bun installs those as symlinks, module resolution runs from the REAL
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4df171dc..aec717f4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -89,7 +89,8 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          # Pinned (bump .bun-version on purpose): `latest` changes under us.
+          bun-version-file: .bun-version
 
       - name: Setup Node (npm publish + provenance)
         uses: actions/setup-node@v4