diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1142382..99e0ab9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,6 +17,10 @@ concurrency:
 
 env:
   CARGO_TERM_COLOR: always
+  # Pinned to what release.yml uses. This workflow runs the same build, so a
+  # different toolchain version here would let CI pass on something the release
+  # then fails on — which is the drift this parity is meant to remove.
+  BUN_VERSION: 1.3.14
   NODE_VERSION: 24
 
 jobs:
@@ -64,14 +68,16 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install wasm-pack
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@91ddec75689c4c78665b598d188dc821c5a43e5c # v2.85.9
         with:
-          tool: wasm-pack
+          # Same pin as the release workflow: this job now runs the same build,
+          # and the point is for it to fail here rather than there.
+          tool: wasm-pack,protoc@3.35.1
 
       - name: Install Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: latest
+          bun-version: ${{ env.BUN_VERSION }}
 
       - name: Install Node.js ${{ env.NODE_VERSION }}
         uses: actions/setup-node@v6
@@ -81,14 +87,11 @@ jobs:
       - name: Install JavaScript dependencies
         run: bun install
 
-      - name: Build WASM package
-        run: |
-          wasm-pack build --target web --out-dir pkg --release
-          # Fix .gitignore issue in pkg (wasm-pack includes it by default)
-          rm -f pkg/.gitignore
-
-      - name: Run TypeScript compilation (generate .d.ts)
-        run: bun run build:ts
+      # The package's real build, the same command the release runs. Calling
+      # wasm-pack and build:ts directly skipped `gen`, so a codegen or tooling
+      # break surfaced for the first time at publish, where it costs a version.
+      - name: Build the wasm package
+        run: bun run build
 
       - name: Run Tests with Bun
         run: bun test
@@ -114,14 +117,14 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install wasm-pack
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@91ddec75689c4c78665b598d188dc821c5a43e5c # v2.85.9
         with:
           tool: wasm-pack
 
       - name: Install Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: latest
+          bun-version: ${{ env.BUN_VERSION }}
 
       - name: Install Node.js ${{ env.NODE_VERSION }}
         uses: actions/setup-node@v6
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 05ad12c..fb97b9f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -215,13 +215,12 @@ jobs:
       - name: Install wasm-pack
         uses: taiki-e/install-action@91ddec75689c4c78665b598d188dc821c5a43e5c # v2.85.9
         with:
-          # protoc: `bun run build` regenerates the proto codec, which ci.yml
-          # never exercises because it calls wasm-pack and build:ts directly.
-          # protoc pinned like bun and npm: verify and publish each install it, and
-          # publish can start much later behind the environment gate, so an
-          # unpinned default could generate one codec for the tests and another
-          # for the tarball.
-          tool: wasm-pack,protoc@35.1
+          # protoc is needed because `bun run build` regenerates the proto
+          # codec. Pinned to the same versions ci.yml uses, so a break shows up
+          # on a pull request; and pinned at all because publish can start much
+          # later than verify, behind the environment gate, where a new default
+          # would generate one codec for the tests and another for the tarball.
+          tool: wasm-pack,protoc@3.35.1
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
@@ -287,13 +286,12 @@ jobs:
       - name: Install wasm-pack
         uses: taiki-e/install-action@91ddec75689c4c78665b598d188dc821c5a43e5c # v2.85.9
         with:
-          # protoc: `bun run build` regenerates the proto codec, which ci.yml
-          # never exercises because it calls wasm-pack and build:ts directly.
-          # protoc pinned like bun and npm: verify and publish each install it, and
-          # publish can start much later behind the environment gate, so an
-          # unpinned default could generate one codec for the tests and another
-          # for the tarball.
-          tool: wasm-pack,protoc@35.1
+          # protoc is needed because `bun run build` regenerates the proto
+          # codec. Pinned to the same versions ci.yml uses, so a break shows up
+          # on a pull request; and pinned at all because publish can start much
+          # later than verify, behind the environment gate, where a new default
+          # would generate one codec for the tests and another for the tarball.
+          tool: wasm-pack,protoc@3.35.1
 
       # Pinned, unlike ci.yml: this bun builds the wasm artifact that ships to
       # npm, so a floating version would change the published bytes without a