diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 28148752..7337e5a2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -93,15 +93,15 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       - name: Cache Bun packages
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: ~/.bun/install/cache
-          key: ${{ runner.os }}-codeapi-api-bun-1.4.2-${{ hashFiles('api/bun.lock') }}
+          key: ${{ runner.os }}-codeapi-api-bun-1.4.4-${{ hashFiles('api/bun.lock') }}
           restore-keys: |
-            ${{ runner.os }}-codeapi-api-bun-1.4.2-
+            ${{ runner.os }}-codeapi-api-bun-1.4.4-
 
       - name: Install dependencies
         run: bun ci
@@ -149,7 +149,7 @@ jobs:
             --workdir /work/api \
             --env SANDBOX_CLEANUP_TMPFS_TEST=1 \
             --env SANDBOX_LOG_LEVEL=error \
-            oven/bun:1.4.2-debian \
+            oven/bun:1.4.4-debian \
             bun test src/cleanup.integration.test.ts
 
   nsjail-ipc-tests:
@@ -164,7 +164,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
       - name: Render native sandbox policy
         working-directory: api
         run: |
@@ -271,15 +271,15 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       - name: Cache Bun packages
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: ~/.bun/install/cache
-          key: ${{ runner.os }}-codeapi-service-bun-1.4.2-${{ hashFiles('service/bun.lock') }}
+          key: ${{ runner.os }}-codeapi-service-bun-1.4.4-${{ hashFiles('service/bun.lock') }}
           restore-keys: |
-            ${{ runner.os }}-codeapi-service-bun-1.4.2-
+            ${{ runner.os }}-codeapi-service-bun-1.4.4-
 
       - name: Install dependencies
         run: bun ci
@@ -395,7 +395,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       - name: Install service dependencies
         working-directory: service
@@ -467,7 +467,7 @@ jobs:
           docker buildx inspect --bootstrap
 
       - name: Build Lambda MicroVM runner image
-        # The target pins Bun 1.4.2 and installs api/bun.lock frozen. Building
+        # The target pins Bun 1.4.4 and installs api/bun.lock frozen. Building
         # natively catches architecture-specific package and Docker layer
         # failures without retaining a second multi-gigabyte image copy.
         run: |
diff --git a/api/Dockerfile b/api/Dockerfile
index 40429b72..e7dbcc4e 100644
--- a/api/Dockerfile
+++ b/api/Dockerfile
@@ -50,7 +50,7 @@ ENV SANDBOX_PIPE_ADDON=/usr/local/lib/anonymous-pipes.node
 COPY docker/python-runtime /python-runtime
 RUN python3 /python-runtime/install.py
 COPY --from=node:22.23.4-slim /usr/local/bin/node /usr/local/bin/node
-COPY --from=oven/bun:1.4.2-debian /usr/local/bin/bun /usr/local/bin/bun
+COPY --from=oven/bun:1.4.4-debian /usr/local/bin/bun /usr/local/bin/bun
 
 # ============================================================================
 # Stage 1b: Build language runtime packages (only consumed by sandbox-runner-baked)
@@ -64,7 +64,7 @@ FROM buildpack-deps:bookworm AS package-builder
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV PYTHON_VERSION=3.14.4
-ENV BUN_VERSION=1.4.2
+ENV BUN_VERSION=1.4.4
 
 COPY docker/apt-install.sh /usr/local/bin/apt-install
 RUN chmod +x /usr/local/bin/apt-install
@@ -87,7 +87,7 @@ RUN chmod +x /package-init.sh && FORCE_REBUILD=true /package-init.sh
 # ============================================================================
 # Stage 2: Build sandbox rootfs
 # ============================================================================
-FROM oven/bun:1.4.2-debian AS sandbox-build
+FROM oven/bun:1.4.4-debian AS sandbox-build
 
 ENV DEBIAN_FRONTEND=noninteractive
 
diff --git a/api/src/package-init.test.ts b/api/src/package-init.test.ts
index a9431bd2..ecb54ba6 100644
--- a/api/src/package-init.test.ts
+++ b/api/src/package-init.test.ts
@@ -28,7 +28,7 @@ for (const oldRuntimeExists of [false, true]) {
                     args: ['hello world', '--version'],
                 },
                 {
-                    directory: 'bun/1.4.2',
+                    directory: 'bun/1.4.4',
                     binary: 'bun',
                     args: ['run', 'hello world', '--version'],
                 },
@@ -131,7 +131,7 @@ for (const oldRuntimeExists of [false, true]) {
                 FORCE_REBUILD: 'false',
                 PYTHON_VERSION: '3.14.4',
                 NODE_VERSION: '24.22.1',
-                BUN_VERSION: '1.4.2',
+                BUN_VERSION: '1.4.4',
                 BASH_PACKAGE_VERSION: '5.2.0',
                 JS_PACKAGE_MANIFEST: manifest,
             };
diff --git a/build-packages.sh b/build-packages.sh
index 59d54750..71015682 100755
--- a/build-packages.sh
+++ b/build-packages.sh
@@ -10,7 +10,7 @@
 # Environment Variables:
 #   PYTHON_VERSION=3.14.4    # Python version to install
 #   NODE_VERSION=24.22.1     # Node.js version to install
-#   BUN_VERSION=1.4.2       # Bun version to install
+#   BUN_VERSION=1.4.4       # Bun version to install
 #   BASH_PACKAGE_VERSION=5.2.0 # Bash package registration version (semver-like x.y.z)
 #   SKIP_PYTHON_PACKAGES=1   # Skip Python pip packages
 #   SKIP_JS_PACKAGES=1       # Skip JavaScript npm packages for Node/Bun
@@ -28,7 +28,7 @@ cd "$SCRIPT_DIR"
 
 PYTHON_VERSION="${PYTHON_VERSION:-3.14.4}"
 NODE_VERSION="${NODE_VERSION:-24.22.1}"
-BUN_VERSION="${BUN_VERSION:-1.4.2}"
+BUN_VERSION="${BUN_VERSION:-1.4.4}"
 PACKAGES_DIR="./data/pkgs"
 JS_PACKAGE_MANIFEST="${JS_PACKAGE_MANIFEST:-${SCRIPT_DIR}/javascript-packages.txt}"
 
diff --git a/docker/Dockerfile.worker-sandbox b/docker/Dockerfile.worker-sandbox
index 7f94409c..824039ec 100644
--- a/docker/Dockerfile.worker-sandbox
+++ b/docker/Dockerfile.worker-sandbox
@@ -68,7 +68,7 @@ FROM buildpack-deps:bookworm AS package-builder
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV PYTHON_VERSION=3.14.4
-ENV BUN_VERSION=1.4.2
+ENV BUN_VERSION=1.4.4
 
 COPY docker/apt-install.sh /usr/local/bin/apt-install
 RUN chmod +x /usr/local/bin/apt-install
@@ -91,7 +91,7 @@ RUN chmod +x /package-init.sh && FORCE_REBUILD=true /package-init.sh
 # ============================================================================
 # Stage 2: Build worker
 # ============================================================================
-FROM oven/bun:1.4.2 AS worker-builder
+FROM oven/bun:1.4.4 AS worker-builder
 WORKDIR /app
 COPY service/package.json service/bun.lock ./
 RUN bun install --frozen-lockfile
@@ -104,7 +104,7 @@ RUN bun build ./src/worker-server.ts --minify --outdir .build --target bun --ext
 # ============================================================================
 # Stage 3: Build sandbox API
 # ============================================================================
-FROM oven/bun:1.4.2 AS sandbox-builder
+FROM oven/bun:1.4.4 AS sandbox-builder
 WORKDIR /app
 COPY api/package.json ./
 RUN bun install --frozen-lockfile
@@ -117,7 +117,7 @@ RUN bun build ./src/index.ts --minify --outdir .build --target bun --external '@
 # ============================================================================
 # Stage 4: Build sandbox rootfs (full OS layer for the microVM guest)
 # ============================================================================
-FROM oven/bun:1.4.2-debian AS sandbox-rootfs
+FROM oven/bun:1.4.4-debian AS sandbox-rootfs
 
 ENV DEBIAN_FRONTEND=noninteractive
 
diff --git a/docker/package-init.sh b/docker/package-init.sh
index 2273721c..7551504e 100644
--- a/docker/package-init.sh
+++ b/docker/package-init.sh
@@ -21,7 +21,7 @@ PYTHON_ALIAS="python${PYTHON_SITE_VERSION}"
 PYTHON_PACKAGE_INSTALLER="${PYTHON_PACKAGE_INSTALLER:-uv}"
 UV_VERSION="${UV_VERSION:-0.11.26}"
 NODE_VERSION="${NODE_VERSION:-24.22.1}"
-BUN_VERSION="${BUN_VERSION:-1.4.2}"
+BUN_VERSION="${BUN_VERSION:-1.4.4}"
 BASH_PACKAGE_VERSION="${BASH_PACKAGE_VERSION:-5.2.0}"
 INSTALL_FAILED=false
 JS_PACKAGE_MANIFEST="${JS_PACKAGE_MANIFEST:-${SCRIPT_DIR}/javascript-packages.txt}"
diff --git a/docs/SECURITY-MAINTENANCE.md b/docs/SECURITY-MAINTENANCE.md
index f33e509f..05631de6 100644
--- a/docs/SECURITY-MAINTENANCE.md
+++ b/docs/SECURITY-MAINTENANCE.md
@@ -120,7 +120,7 @@ does not mount. The namespace-disabled native policy tests cover those APIs
 when shared memory exists, not their availability in the default jail.
 
 With runtime packages built by `build-packages.sh` (or a compatible `/pkgs`
-tree containing Python 3.14.4 and Bun 1.4.2), run from the repository root:
+tree containing Python 3.14.4 and Bun 1.4.4), run from the repository root:
 
 ```sh
 bun service/scripts/dump-pipe-preamble.ts > /tmp/codeapi-pipe-client.py
@@ -180,7 +180,7 @@ Remaining service audit findings at this change:
 - `braces` (GHSA-vfj7-8cjw-p6xm): development-only dependency with no published
   fix. Do not feed untrusted patterns to build tooling; track an upstream fix.
 
-Bun 1.4.2 subprocess spawning with piped stdio also uses socketpairs and is
+Bun 1.4.4 subprocess spawning with piped stdio also uses socketpairs and is
 denied by this policy. Basic JS/TS execution remains supported. Replacing Bun
 subprocess IPC requires a separate runtime change; do not re-enable socketpairs
 to provide that compatibility.
diff --git a/helm/codeapi/values.yaml b/helm/codeapi/values.yaml
index beca089d..33c32af0 100644
--- a/helm/codeapi/values.yaml
+++ b/helm/codeapi/values.yaml
@@ -311,7 +311,7 @@ workerSandbox:
         pullPolicy: Always
       pythonVersion: "3.14.4"
       nodeVersion: "24.22.1"
-      bunVersion: "1.4.2"
+      bunVersion: "1.4.4"
       bashPackageVersion: "5.2.0"
       backoffLimit: 2
       ttlSecondsAfterFinished: 3600
diff --git a/launcher/Dockerfile b/launcher/Dockerfile
index f7c305fb..95a4d48d 100644
--- a/launcher/Dockerfile
+++ b/launcher/Dockerfile
@@ -49,7 +49,7 @@ RUN gcc -shared -fPIC -O2 -Wall -Wextra -Werror -I/usr/local/include/node -o /us
     && gcc -O2 -static -o /usr/local/bin/sandbox-rootfs-setup /tmp/rootfs-setup.c \
     && chmod 0111 /usr/local/bin/spec-guard /usr/local/bin/sandbox-rootfs-setup
 
-FROM oven/bun:1.4.2-debian AS sandbox-build
+FROM oven/bun:1.4.4-debian AS sandbox-build
 
 ENV DEBIAN_FRONTEND=noninteractive
 
diff --git a/service/Dockerfile b/service/Dockerfile
index d7bf9036..805d6c5c 100644
--- a/service/Dockerfile
+++ b/service/Dockerfile
@@ -1,5 +1,5 @@
 # File Server Dockerfile
-FROM oven/bun:1.4.2 AS base
+FROM oven/bun:1.4.4 AS base
 WORKDIR /app
 
 # Install dependencies
@@ -27,7 +27,7 @@ RUN bun build ./src/worker-server.ts --minify --outdir .build-worker --target bu
 RUN bun build ./src/egress-gateway.ts --minify --outdir .build-egress-gateway --target bun --external '@opentelemetry/*'
 
 # File server production
-FROM oven/bun:1.4.2 AS production
+FROM oven/bun:1.4.4 AS production
 ENV NODE_ENV=production
 WORKDIR /app
 COPY --from=install /temp/prod/node_modules ./node_modules
@@ -35,7 +35,7 @@ COPY --from=builder /app/.build ./.build
 CMD ["bun", "run", ".build/file-server.js"]
 
 # API server (HTTP on port 3112)
-FROM oven/bun:1.4.2 AS api
+FROM oven/bun:1.4.4 AS api
 ENV NODE_ENV=production
 WORKDIR /app
 COPY --from=install /temp/prod/node_modules ./node_modules
@@ -45,7 +45,7 @@ COPY --from=builder /app/src/*.py ./src/
 CMD ["bun", "run", ".build-api/api-server.js"]
 
 # Worker server (job processor, health on port 3113)
-FROM oven/bun:1.4.2 AS worker
+FROM oven/bun:1.4.4 AS worker
 ENV NODE_ENV=production
 WORKDIR /app
 COPY --from=install /temp/prod/node_modules ./node_modules
@@ -54,7 +54,7 @@ COPY --from=builder /app/src/*.py ./src/
 CMD ["bun", "run", ".build-worker/worker-server.js"]
 
 # Egress gateway (sandbox outbound delegation)
-FROM oven/bun:1.4.2 AS egress-gateway
+FROM oven/bun:1.4.4 AS egress-gateway
 ENV NODE_ENV=production
 WORKDIR /app
 COPY --from=install /temp/prod/node_modules ./node_modules
diff --git a/service/Dockerfile.api b/service/Dockerfile.api
index 1da68c46..6a571db8 100644
--- a/service/Dockerfile.api
+++ b/service/Dockerfile.api
@@ -1,7 +1,7 @@
 # API-Only Server Dockerfile
 # This builds the HTTP API server without workers
 # Scale this based on HTTP traffic
-FROM oven/bun:1.4.2 AS base
+FROM oven/bun:1.4.4 AS base
 WORKDIR /app
 
 # Install dependencies
@@ -27,7 +27,7 @@ RUN bun build ./src/api-server.ts --minify --outdir .build --target bun --extern
 RUN bun build ./scripts/rehydrate-session-cache.ts --minify --outdir .build-migrations --target bun --external '@opentelemetry/*'
 
 # Production stage
-FROM oven/bun:1.4.2 AS production
+FROM oven/bun:1.4.4 AS production
 ENV NODE_ENV=production
 WORKDIR /app
 # Install curl for healthcheck (not included in bun base image)
diff --git a/service/Dockerfile.bun b/service/Dockerfile.bun
index d545f32c..941c7183 100644
--- a/service/Dockerfile.bun
+++ b/service/Dockerfile.bun
@@ -1,5 +1,5 @@
 # Base stage
-FROM oven/bun:1.4.2 AS base
+FROM oven/bun:1.4.4 AS base
 WORKDIR /usr/src/app
 
 # Install dependencies
diff --git a/service/Dockerfile.egress-gateway b/service/Dockerfile.egress-gateway
index bd1d2b64..cde97938 100644
--- a/service/Dockerfile.egress-gateway
+++ b/service/Dockerfile.egress-gateway
@@ -1,5 +1,5 @@
 # Egress Gateway Dockerfile
-FROM oven/bun:1.4.2 AS base
+FROM oven/bun:1.4.4 AS base
 WORKDIR /app
 
 FROM base AS install
@@ -11,7 +11,7 @@ RUN mkdir -p /temp/prod
 COPY service/package.json service/bun.lock /temp/prod/
 RUN cd /temp/prod && bun install --frozen-lockfile --production
 
-FROM oven/bun:1.4.2 AS production
+FROM oven/bun:1.4.4 AS production
 ENV NODE_ENV=production
 WORKDIR /app
 RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*
diff --git a/service/Dockerfile.local b/service/Dockerfile.local
index 4ed93ee4..216e9c31 100644
--- a/service/Dockerfile.local
+++ b/service/Dockerfile.local
@@ -1,5 +1,5 @@
 # Local development Dockerfile - no authentication required
-FROM oven/bun:1.4.2 AS base
+FROM oven/bun:1.4.4 AS base
 WORKDIR /app
 
 # Install dependencies
@@ -22,7 +22,7 @@ COPY service/tsconfig.json ./
 RUN bun build ./src/local-api.ts --minify --outdir .build --target bun --external '@opentelemetry/*'
 
 # Production stage
-FROM oven/bun:1.4.2 AS production
+FROM oven/bun:1.4.4 AS production
 ENV NODE_ENV=production
 WORKDIR /app
 COPY --from=install /temp/prod/node_modules ./node_modules
diff --git a/service/Dockerfile.service b/service/Dockerfile.service
index d5d4e6d9..dea1cea3 100644
--- a/service/Dockerfile.service
+++ b/service/Dockerfile.service
@@ -1,5 +1,5 @@
 # Service API Dockerfile
-FROM oven/bun:1.4.2 AS base
+FROM oven/bun:1.4.4 AS base
 WORKDIR /usr/src/app
 
 # Install dependencies
diff --git a/service/Dockerfile.tool-call-server b/service/Dockerfile.tool-call-server
index 76afb837..95543ee7 100644
--- a/service/Dockerfile.tool-call-server
+++ b/service/Dockerfile.tool-call-server
@@ -1,5 +1,5 @@
 # Tool Call Server Dockerfile
-FROM oven/bun:1.4.2 AS base
+FROM oven/bun:1.4.4 AS base
 WORKDIR /app
 
 # Install dependencies
@@ -13,7 +13,7 @@ COPY service/package.json service/bun.lock /temp/prod/
 RUN cd /temp/prod && bun install --frozen-lockfile --production
 
 # Production stage
-FROM oven/bun:1.4.2 AS production
+FROM oven/bun:1.4.4 AS production
 ENV NODE_ENV=production
 WORKDIR /app
 COPY --from=install /temp/prod/node_modules ./node_modules
diff --git a/service/Dockerfile.worker b/service/Dockerfile.worker
index bb7b6945..059ce2aa 100644
--- a/service/Dockerfile.worker
+++ b/service/Dockerfile.worker
@@ -2,7 +2,7 @@
 # This builds the job processing worker without HTTP server
 # Deploy alongside a sandbox sidecar for execution
 # Scale this based on queue depth
-FROM oven/bun:1.4.2 AS base
+FROM oven/bun:1.4.4 AS base
 WORKDIR /app
 
 # Install dependencies
@@ -25,7 +25,7 @@ COPY service/tsconfig.json ./
 RUN bun build ./src/worker-server.ts --minify --outdir .build --target bun --external '@opentelemetry/*'
 
 # Production stage
-FROM oven/bun:1.4.2 AS production
+FROM oven/bun:1.4.4 AS production
 ENV NODE_ENV=production
 WORKDIR /app
 # Install curl for healthcheck
diff --git a/service/src/config.spec.ts b/service/src/config.spec.ts
index 45ae5700..e5af81cf 100644
--- a/service/src/config.spec.ts
+++ b/service/src/config.spec.ts
@@ -80,15 +80,15 @@ describe('runtime version configuration', () => {
     });
   });
 
-  it('maps Bun JavaScript and TypeScript requests to Bun 1.4.2', () => {
+  it('maps Bun JavaScript and TypeScript requests to Bun 1.4.4', () => {
     expect(languageConfig[Languages.js]).toMatchObject({
       language: 'bun-js',
-      version: '1.4.2',
+      version: '1.4.4',
       fileName: 'index.js',
     });
     expect(languageConfig[Languages.ts]).toMatchObject({
       language: 'bun-ts',
-      version: '1.4.2',
+      version: '1.4.4',
       fileName: 'main.ts',
     });
   });
diff --git a/service/src/config.ts b/service/src/config.ts
index 6a49ea36..8abfa54f 100644
--- a/service/src/config.ts
+++ b/service/src/config.ts
@@ -11,10 +11,10 @@ import { BRIDGE_WORKSPACE_IMPORT_FILE_DEFAULT_MAX_BYTES } from '../../packages/c
 
 export const languageConfig: Record<Languages | string, t.LanguageConfig | undefined> = {
   [Languages.bash]: { language: 'bash', version: '5.2.0', fileName: 'script.sh' },
-  [Languages.js]: { language: 'bun-js', version: '1.4.2', fileName: 'index.js' },
+  [Languages.js]: { language: 'bun-js', version: '1.4.4', fileName: 'index.js' },
   [Languages.node]: { language: 'node', version: '24.22.1', fileName: 'index.js' },
   [Languages.py]: { language: 'python', version: '3.14.4', fileName: 'main.py' },
-  [Languages.ts]: { language: 'bun-ts', version: '1.4.2', fileName: 'main.ts' },
+  [Languages.ts]: { language: 'bun-ts', version: '1.4.4', fileName: 'main.ts' },
 };
 
 const languageAliases: Record<string, Languages> = {
diff --git a/service/src/workspace-tools/outcome.ts b/service/src/workspace-tools/outcome.ts
index e8dc100f..03b54c5e 100644
--- a/service/src/workspace-tools/outcome.ts
+++ b/service/src/workspace-tools/outcome.ts
@@ -30,6 +30,7 @@ export function getWorkspaceToolOutcome(res: Response, route = '/workspace-tools
   if (existing != null) return existing;
   const startedAt = performance.now();
   let responseEndedAt: number | undefined;
+  let responseFinished = false;
   let logged = false;
   const outcome: WorkspaceToolOutcome = {
     dispatchPending: false,
@@ -37,7 +38,7 @@ export function getWorkspaceToolOutcome(res: Response, route = '/workspace-tools
       if (logged || responseEndedAt == null || outcome.dispatchPending) return;
       logged = true;
       outcomes.delete(res);
-      const finished = res.writableFinished;
+      const finished = responseFinished;
       logger.log(finished && res.statusCode < 400 ? 'info' : 'warn', 'Workspace tool request completed', {
         route,
         operation: outcome.operation,
@@ -55,6 +56,8 @@ export function getWorkspaceToolOutcome(res: Response, route = '/workspace-tools
     res.removeListener('finish', onResponseEnd);
     res.removeListener('close', onResponseEnd);
     responseEndedAt = performance.now();
+    // Late dispatch settlement can write to a closed response. Preserve its state at close.
+    responseFinished = res.writableFinished;
     outcome.flush();
   };
   outcomes.set(res, outcome);
diff --git a/service/src/workspace-tools/router.test.ts b/service/src/workspace-tools/router.test.ts
index 8a753c08..e3ed54bd 100644
--- a/service/src/workspace-tools/router.test.ts
+++ b/service/src/workspace-tools/router.test.ts
@@ -534,11 +534,9 @@ test('logs a disconnected dispatch once without inventing HTTP 200', async () =>
   const settlementGate = Promise.withResolvers<void>();
   let dispatchAborted = false;
   let queueRemaining: number | undefined;
-  let closeConnection = (): void => { throw new Error('connection not ready'); };
   app.use(json());
   app.use((req, res, next) => {
     applyPrincipal(req, { userId: 'user-1', tenantId: 'tenant-1', principalSource: 'librechat_jwt', codeWorkerId: 'user-worker' });
-    closeConnection = (): void => { res.destroy(); };
     res.once('close', () => closed.resolve());
     next();
   });
@@ -578,7 +576,7 @@ test('logs a disconnected dispatch once without inventing HTTP 200', async () =>
     body: JSON.stringify({ protocolVersion: 1, operation: 'list_files', workspaceId: 'primary' }),
   });
   await started.promise;
-  closeConnection();
+  controller.abort();
   await expect(response).rejects.toThrow();
   await closed.promise;
   expect(queueRemaining).toBeGreaterThan(29_000);
diff --git a/tests/package_init_runtime_rollout.sh b/tests/package_init_runtime_rollout.sh
index 9c09d542..839d9a7c 100755
--- a/tests/package_init_runtime_rollout.sh
+++ b/tests/package_init_runtime_rollout.sh
@@ -17,6 +17,7 @@ render() {
 }
 # The hook installs the runtime selected by service requests.
 render | grep -A 1 'name: NODE_VERSION' | grep -q 'value: "24.22.1"'
+render | grep -A 1 'name: BUN_VERSION' | grep -q 'value: "1.4.4"'
 # Explicit runtime selections still override the chart default.
 render --set workerSandbox.packages.initJob.nodeVersion=24.22.0 \
     | grep -A 1 'name: NODE_VERSION' | grep -q 'value: "24.22.0"'
diff --git a/tests/tool_call_runner.cjs b/tests/tool_call_runner.cjs
index 61ddcb9e..7028d9cc 100644
--- a/tests/tool_call_runner.cjs
+++ b/tests/tool_call_runner.cjs
@@ -118,8 +118,8 @@ if __name__ == '__main__':
     const plain = await execute("import os, asyncio; assert not os.path.exists('/proc/self/fd/3'); asyncio.run(asyncio.to_thread(lambda: 1)); print('PASS: ordinary asyncio execution without pipe capability')", false);
     console.log(plain.run.stdout.trim());
     for (const language of ['bun-js', 'bun-ts']) {
-      const js = await execute("let denied = false; try { Bun.spawn([process.execPath, '-e', '0'], {stdout:'pipe', stderr:'pipe'}); } catch (error) { if (error.code !== 'EPERM' || error.syscall !== 'socketpair') throw error; denied = true; } if (!denied) throw new Error('socketpair spawn allowed'); console.log('PASS: Bun ' + Bun.version + ', socketpair-based spawn denied')", false, language, '1.4.2');
-      assert(js.run.stdout.includes('PASS: Bun 1.4.2'), JSON.stringify(js));
+      const js = await execute("let denied = false; try { Bun.spawn([process.execPath, '-e', '0'], {stdout:'pipe', stderr:'pipe'}); } catch (error) { if (error.code !== 'EPERM' || error.syscall !== 'socketpair') throw error; denied = true; } if (!denied) throw new Error('socketpair spawn allowed'); console.log('PASS: Bun ' + Bun.version + ', socketpair-based spawn denied')", false, language, '1.4.4');
+      assert(js.run.stdout.includes('PASS: Bun 1.4.4'), JSON.stringify(js));
       console.log(language + ': ' + js.run.stdout.trim());
     }
   } finally {