diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index bca12dcf..bb5a0274 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -35,6 +35,14 @@ jobs:
         with:
           fetch-depth: 1
 
+      # Pin bun to the repo's packageManager version so `--frozen-lockfile` is
+      # deterministic regardless of the (disposable, latest-bun) runner image.
+      # Without this, a newer ambient bun rejects the committed lockfile.
+      - name: Setup pinned bun (1.2.6)
+        run: |
+          curl -fsSL https://bun.sh/install | bash -s "bun-v1.2.6"
+          echo "$HOME/.bun/bin" >> "$GITHUB_PATH"
+
       - name: Cache bun dependencies
         uses: actions/cache@v3
         with: