diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 760439a..ff3ae72 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,7 +36,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
diff --git a/.github/workflows/dependabot-bun-lock.yml b/.github/workflows/dependabot-bun-lock.yml
index d85cb08..6c6d106 100644
--- a/.github/workflows/dependabot-bun-lock.yml
+++ b/.github/workflows/dependabot-bun-lock.yml
@@ -34,7 +34,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       # No dependency lifecycle scripts: this job holds a write token.
       - name: Refresh bun.lock
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3dbf0d6..9a35a19 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -28,7 +28,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
diff --git a/AGENTS.md b/AGENTS.md
index 537673a..12a4d18 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -12,7 +12,7 @@ Conventions for human contributors and AI agents working on this repository.
 
 ## Commands
 
-- `bun install` — install dependencies (Bun 1.4.2; `bun.lock` and `package-lock.json` are both committed).
+- `bun install` — install dependencies (Bun 1.4.4; `bun.lock` and `package-lock.json` are both committed).
 - `bun run test` — run vitest once.
 - `bun run typecheck` — strict TypeScript check.
 - `bun run check` — type check + biome.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0e287f7..8ab708a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@
 - Peer dependencies on `@earendil-works/pi-*` are `>=0.87.1` instead of `*`. 0.87.1 is the oldest pi the extension is verified against: typecheck and the full test suite pass with every `@earendil-works` package at 0.87.1.
 - CI: the Dependabot `bun.lock` refresh approves the CI run its own push starts, so the required checks attach to the pull request, and falls back to dispatching `ci.yml` if that run cannot be approved.
 - CI: the publish workflow no longer has an npm publish step; the package is distributed via git. A release now fails when its tag does not match `package.json`.
+- CI and the development docs use Bun 1.4.4 (was 1.4.2).
 
 ## [0.1.4] - 2026-10-03
 
diff --git a/README.md b/README.md
index bdd8583..d64b15b 100644
--- a/README.md
+++ b/README.md
@@ -69,7 +69,7 @@ npm pack --dry-run
 pi -e ./src/index.ts
 ```
 
-Development and CI use Bun 1.4.2. `package-lock.json` is kept alongside `bun.lock` so `npm ci && npm test` keeps working for npm consumers.
+Development and CI use Bun 1.4.4. `package-lock.json` is kept alongside `bun.lock` so `npm ci && npm test` keeps working for npm consumers.
 
 The test suite uses vitest. TypeScript is strict, Node-only, and uses ESM imports with `.js` suffixes.