diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d5bc74dae..d26c64f42 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.3.9"
+          bun-version: "1.4.2"
       - uses: actions/setup-java@v4
         with:
           distribution: temurin
@@ -114,7 +114,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.3.9"
+          bun-version: "1.4.2"
       - name: Setup Blacksmith Builder
         uses: useblacksmith/setup-docker-builder@v1
       - name: Install dependencies
@@ -151,7 +151,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.3.9"
+          bun-version: "1.4.2"
       - name: Install tmux
         run: sudo apt-get update && sudo apt-get install --yes tmux
       - name: Install dependencies
@@ -182,7 +182,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.3.9"
+          bun-version: "1.4.2"
       - name: Install dependencies
         run: bun install
       - name: Typecheck (Turbo)
@@ -206,7 +206,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.3.9"
+          bun-version: "1.4.2"
       - name: Require native regression tools
         run: |
           command -v python3
diff --git a/.github/workflows/release-node-runtime-image.yml b/.github/workflows/release-node-runtime-image.yml
index ecc0250e0..21f926655 100644
--- a/.github/workflows/release-node-runtime-image.yml
+++ b/.github/workflows/release-node-runtime-image.yml
@@ -27,7 +27,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.3.9"
+          bun-version: "1.4.2"
 
       - name: Setup QEMU
         uses: docker/setup-qemu-action@v3
diff --git a/.github/workflows/release-prepare.yml b/.github/workflows/release-prepare.yml
index e7690cf49..ba5001c0e 100644
--- a/.github/workflows/release-prepare.yml
+++ b/.github/workflows/release-prepare.yml
@@ -33,7 +33,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.3.9"
+          bun-version: "1.4.2"
 
       - name: Install dependencies
         run: bun install
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 47943bfa0..ca0b09aed 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,7 +26,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.3.9"
+          bun-version: "1.4.2"
       - name: Resolve version
         id: version
         run: |
@@ -78,7 +78,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.3.9"
+          bun-version: "1.4.2"
       - name: Install dependencies
         run: bun install
       - name: Build release artifacts
@@ -171,7 +171,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.3.9"
+          bun-version: "1.4.2"
       - name: Render formula
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.tool-versions b/.tool-versions
index 7eb3673c0..e7521662c 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,3 +1,3 @@
-bun  1.3.9
+bun  1.4.2
 nodejs 24.11.0
 zig  0.15.2
diff --git a/docker/node-runtime/Dockerfile b/docker/node-runtime/Dockerfile
index 23b8b1c72..58eca2a73 100644
--- a/docker/node-runtime/Dockerfile
+++ b/docker/node-runtime/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.7
 
-FROM oven/bun:1.3.9 AS hack-build
+FROM oven/bun:1.4.2 AS hack-build
 
 WORKDIR /src
 COPY package.json bun.lock bunfig.toml tsconfig.json index.ts ./
diff --git a/docker/slim-runtime/Dockerfile b/docker/slim-runtime/Dockerfile
index 17ef7f3d4..2b8b17cc8 100644
--- a/docker/slim-runtime/Dockerfile
+++ b/docker/slim-runtime/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.7
 
-FROM oven/bun:1.3.9 AS hack-build
+FROM oven/bun:1.4.2 AS hack-build
 
 WORKDIR /src
 COPY package.json bun.lock bunfig.toml tsconfig.json index.ts ./
@@ -10,7 +10,7 @@ COPY src ./src
 RUN bun install --frozen-lockfile
 RUN bun build index.ts --compile --outfile /out/hack
 
-FROM oven/bun:1.3.9
+FROM oven/bun:1.4.2
 
 ARG HACK_VERSION=dev
 ARG BUILD_DATE=unknown
diff --git a/docs/guides/native-candidate.md b/docs/guides/native-candidate.md
index 258774a19..eb3c3e896 100644
--- a/docs/guides/native-candidate.md
+++ b/docs/guides/native-candidate.md
@@ -6,7 +6,7 @@ projects, or install DNS or trust automatically. Its graph commands support a
 bounded subset;
 this bundle is not application parity or release qualification.
 
-Build with the repository's pinned Bun 1.3.9, Rust 1.97.1 and Zig 0.15.2 toolchain, Python 3,
+Build with the repository's pinned Bun 1.4.2, Rust 1.97.1 and Zig 0.15.2 toolchain, Python 3,
 and the Rust `aarch64-unknown-linux-musl` standard library already installed. The
 build refuses missing prerequisites; it does not install toolchains:
 
diff --git a/mise.toml b/mise.toml
index bcde2cf92..805b4e6ca 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,5 +1,5 @@
 [tools]
-bun = "1.3.9"
+bun = "1.4.2"
 node = "24.11.0"
 zig = "0.15.2"
 rust = "1.97.1"
diff --git a/package.json b/package.json
index 7ca6004d8..1226a649c 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "hack-cli",
   "version": "4.2.1",
-  "packageManager": "bun@1.3.9",
+  "packageManager": "bun@1.4.2",
   "module": "index.ts",
   "type": "module",
   "workspaces": [
diff --git a/scripts/build-native-candidate.sh b/scripts/build-native-candidate.sh
index 65dae2892..12cd7a2a2 100755
--- a/scripts/build-native-candidate.sh
+++ b/scripts/build-native-candidate.sh
@@ -25,8 +25,8 @@ if [ "$(zig version)" != 0.15.2 ]; then
   exit 69
 fi
 command -v python3 >/dev/null
-if [ "$(bun --version)" != 1.3.9 ]; then
-  echo "Pinned Bun 1.3.9 is required" >&2
+if [ "$(bun --version)" != 1.4.2 ]; then
+  echo "Pinned Bun 1.4.2 is required" >&2
   exit 69
 fi
 stdlib=$(rustc --print target-libdir --target aarch64-unknown-linux-musl)