diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 71a8fda..a6b16dd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,9 +18,17 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # PINNED, deliberately. `latest` let the gate change with no commit and no
+      # review, and it did: bun 1.4.x takes `a persona whose credentials are wrong`
+      # (session-builder.test.ts, ceiling STORY_TIMEOUT_MS = 30_000) from ~2s to
+      # ~30s, so every 1.4.x run lands within 400ms of the ceiling and CI became a
+      # coin flip on every branch including main. 1.3.14 is the last version
+      # measured fast here: 1,962ms on run 31238151616. Bump this deliberately,
+      # and only with a run that shows the persona story well under its ceiling
+      # rather than beside it. The 1.4.x slowdown itself is open as #70.
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: 1.3.14
 
       - name: install
         run: bun install
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1e7e703..31261a5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,9 +38,13 @@ jobs:
       - name: upgrade npm
         run: npm install -g npm@latest
 
+      # Pinned to match ci.yml — see the note there (#70). The version that BUILDS
+      # the published tarball must not drift on its own either: this job runs
+      # `bun run build` and publishes the result, with no test step to catch a
+      # toolchain regression before it reaches npm.
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: 1.3.14
 
       - name: install
         run: bun install --frozen-lockfile