diff --git a/Dockerfile b/Dockerfile
index 0181988..01d84f7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,6 +9,10 @@ RUN apt-get update \
   && apt-get install -y --no-install-recommends make \
   && rm -rf /var/lib/apt/lists/*
 
+# Bundling the Lustre frontend needs Bun; pin it here so the build never
+# downloads one. Keep this tag matching lustre_dev_tools' pinned version.
+COPY --from=oven/bun:1.2.22 /usr/local/bin/bun /usr/local/bin/bun
+
 COPY . .
 
 # `make build` runs codegen, bundles the web app, and stages the frontend into
diff --git a/docs/deploy.md b/docs/deploy.md
index 017153b..0894916 100644
--- a/docs/deploy.md
+++ b/docs/deploy.md
@@ -70,6 +70,12 @@ runs steps as plain Docker containers on the runner's own arch (no emulation
 layer at all, unlike the `microvm` engine's cross-arch case) rather than
 cross-building.
 
+The build bundles the Lustre frontend with **Bun**. To avoid a mid-build
+download from GitHub (why early spindle runs failed), the build stage copies a
+pinned Bun from `oven/bun` and `web/gleam.toml` sets
+`tools.lustre.bin.bun = "system"`; keep the Dockerfile's `oven/bun` tag matching
+`lustre_dev_tools`' pin. No Tailwind entry exists, so Tailwind is never fetched.
+
 One-time setup (already done for `crate.mokkenstorm.dev` as of 2026-07-12):
 
 1. Attach this repo to the hosted spindle from its Tangled settings page
diff --git a/web/gleam.toml b/web/gleam.toml
index d76f58b..2ca1024 100644
--- a/web/gleam.toml
+++ b/web/gleam.toml
@@ -15,3 +15,7 @@ modem = ">= 2.1.3 and < 3.0.0"
 gleeunit = ">= 1.0.0 and < 2.0.0"
 lustre_dev_tools = ">= 2.3.6 and < 3.0.0"
 gleam_http = ">= 4.0.0 and < 5.0.0"
+
+# Use the Bun on PATH (the Docker image pins it) instead of downloading one.
+[tools.lustre.bin]
+bun = "system"