diff --git a/.gitea/workflows/deb.yml b/.gitea/workflows/deb.yml
index 1047367..b22e1f5 100644
--- a/.gitea/workflows/deb.yml
+++ b/.gitea/workflows/deb.yml
@@ -87,6 +87,13 @@ jobs:
         # Gate the .deb on a real node boot: the punktfunk-web .deb runs `node .output/server`,
         # so prove the node-server build exists, isn't a bun bundle, and actually serves /login.
         run: |
+          # bun builds the console. It's baked into the rust-ci image, but bootstrap it here too so
+          # the job stays green against the PREVIOUS image (docker.yml bootstrap lag).
+          command -v bun >/dev/null || {
+            apt-get install -y --no-install-recommends unzip
+            curl -fsSL https://bun.sh/install | bash
+          }
+          export PATH="$HOME/.bun/bin:$PATH"
           cd web
           bun install --frozen-lockfile
           bun run build
diff --git a/ci/rust-ci.Dockerfile b/ci/rust-ci.Dockerfile
index 5a26e96..711a3b9 100644
--- a/ci/rust-ci.Dockerfile
+++ b/ci/rust-ci.Dockerfile
@@ -11,8 +11,8 @@
 FROM ubuntu:26.04
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    # toolchain + bindgen; nodejs runs the JS actions (checkout/cache) inside this container
-    build-essential clang libclang-dev pkg-config cmake git curl ca-certificates nodejs \
+    # toolchain + bindgen; nodejs runs the JS actions (checkout/cache); unzip is for the bun installer
+    build-essential clang libclang-dev pkg-config cmake git curl ca-certificates nodejs unzip \
     # ffmpeg-next 8 (system FFmpeg 8 / libavcodec 62 on 26.04)
     libavcodec-dev libavformat-dev libavutil-dev libswscale-dev libavfilter-dev \
     libavdevice-dev \
@@ -24,6 +24,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libgtk-4-dev libadwaita-1-dev libsdl3-dev \
     && rm -rf /var/lib/apt/lists/*
 
+# bun — builds the punktfunk-web console in deb.yml (which runs the web build in THIS image).
+# ci.yml's web/docs jobs use the oven/bun image instead, so this is only for the deb job.
+RUN curl -fsSL https://bun.sh/install | bash \
+    && install -m0755 /root/.bun/bin/bun /usr/local/bin/bun \
+    && bun --version
+
 # libcuda link stub: the NVIDIA userspace library (no kernel module needed) provides
 # every cuXxx symbol. On 26.04 the package already ships the libcuda.so dev symlink;
 # -sf keeps this idempotent if a future package drops it again.