diff --git a/Dockerfile b/Dockerfile
index c0aebc0..a6712d3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,7 +16,7 @@
 # build; the tag stays for readability and tracks .bun-version (1.3.14, the same
 # Bun the binaries job pins via setup-bun). Bump both the tag and the digest
 # together when .bun-version changes.
-FROM oven/bun:1.3.14@sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4 AS build
+FROM oven/bun:1.4.0@sha256:5ff609364c049b54eb0ff560ec96319729a972078ef2c755d758f0c6ef89c2d6 AS build
 WORKDIR /src
 # bun build --compile bundles only the source it reaches; the CLI imports nothing
 # outside src/, so no package.json/tsconfig and no `bun install` are needed.