diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 42626e7..55c5d9c 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -10,17 +10,6 @@
 {
   $schema: "https://docs.renovatebot.com/renovate-schema.json",
   extends: ["github>firsttris/workflows//renovate/default.json5"],
-  customManagers: [
-    {
-      // "packageManager": "bun@x.y.z" in app/package.json: the Bun of every workflow (setup-bun's
-      // bun-version-file, and npm in the Playwright image of the E2E and screenshots jobs)
-      customType: "regex",
-      managerFilePatterns: ["/^app/package\\.json$/"],
-      matchStrings: ['"packageManager": "bun@(?<currentValue>\\d+\\.\\d+\\.\\d+)"'],
-      depNameTemplate: "bun",
-      datasourceTemplate: "npm",
-    },
-  ],
   packageRules: [
     {
       // Tauri and tauri-specta: the crates and the npm packages in one PR, since the CLI wants
@@ -69,7 +58,8 @@
     },
     {
       // Bun installs the packages and runs the scripts and the Playwright runner; its own PR,
-      // majors too
+      // majors too. Renovate's bun manager reads "packageManager": "bun@x.y.z" in app/package.json
+      // itself, as the npm package `bun` (no regex manager needed).
       matchPackageNames: ["bun"],
       enabled: true,
       groupName: "Bun",
diff --git a/docs/development.md b/docs/development.md
index ae4441b..92abd2c 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -25,7 +25,9 @@ OpenSSH and Git, and for the desktop app the WebKitGTK development files.
     sudo apt install build-essential libwebkit2gtk-4.1-dev libgtk-3-dev librsvg2-dev \
       libayatana-appindicator3-dev openssh-client git
     curl -sSf https://sh.rustup.rs | sh
-    curl -fsSL https://bun.sh/install | bash && cargo install just
+    # the Bun of packageManager in app/package.json
+    curl -fsSL https://bun.sh/install | bash -s "bun-v$(sed -n 's/.*"packageManager": *"bun@\([0-9][^"]*\)".*/\1/p' app/package.json)"
+    cargo install just
     just setup
     ```
 
diff --git a/packaging/toolbox.sh b/packaging/toolbox.sh
index 1c7343e..f2941a2 100755
--- a/packaging/toolbox.sh
+++ b/packaging/toolbox.sh
@@ -2,12 +2,19 @@
 # Creates a Fedora toolbox with everything needed to build Keybund, so the
 # host system (e.g. Bazzite) stays untouched.
 set -euo pipefail
+
+# The Bun of "packageManager" in app/package.json (what CI runs), read without jq or node
+version=$(sed -n 's/.*"packageManager": *"bun@\([0-9][^"]*\)".*/\1/p' "$(dirname "$0")/../app/package.json")
+[[ -n "$version" ]] || { echo "Keine Bun-Version in app/package.json (packageManager)." >&2; exit 1; }
 name="${1:-keybund-dev}"
 toolbox create -y "$name" 2>/dev/null || true
 toolbox run -c "$name" sudo dnf install -y \
   webkit2gtk4.1-devel openssl-devel curl wget file libappindicator-gtk3-devel librsvg2-devel \
   gcc gcc-c++ make patchelf unzip git openssh-clients just
 toolbox run -c "$name" bash -c 'command -v cargo || curl --proto "=https" --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y'
-# Bun installs the frontend's packages and runs its scripts (its installer needs unzip)
-toolbox run -c "$name" bash -c 'command -v bun || curl -fsSL https://bun.sh/install | bash'
+# Bun installs the frontend's packages and runs its scripts: exactly that version, unless it is
+# there already (the official installer takes the release tag and needs unzip)
+printf -v install_bun '[ "$(PATH="$HOME/.bun/bin:$PATH" bun --version 2>/dev/null)" = %q ] || curl -fsSL https://bun.sh/install | bash -s %q' \
+  "$version" "bun-v$version"
+toolbox run -c "$name" bash -c "$install_bun"
 echo "Fertig. Mit 'toolbox enter $name' wechseln, dann 'just setup && just'."