diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 6bf3a82..5162fdc 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -46,16 +46,6 @@
       datasourceTemplate: "github-tags",
       versioningTemplate: "loose",
     },
-    {
-      // "packageManager": "bun@x.y.z": the Bun of every workflow (bun-version-file, and the
-      // npm-installed Bun of the Playwright jobs)
-      customType: "regex",
-      managerFilePatterns: ["/^app/package\\.json$/"],
-      matchStrings: ['"packageManager": "bun@(?<currentValue>\\d+\\.\\d+\\.\\d+)"'],
-      depNameTemplate: "oven-sh/bun",
-      datasourceTemplate: "github-releases",
-      extractVersionTemplate: "^bun-v(?<version>.+)$",
-    },
     {
       // The Flatpak's Bun binaries (their sha256 comes from renovate-flatpak.yml)
       customType: "regex",
@@ -104,8 +94,10 @@
     },
     {
       // Bun: app/package.json's packageManager and the Flatpak's Bun binaries in one PR: the
-      // Flatpak builds offline with the Bun of its manifest.
-      matchPackageNames: ["oven-sh/bun"],
+      // Flatpak builds offline with the Bun of its manifest. Renovate's bun manager reads
+      // "packageManager": "bun@x.y.z" itself, as the npm package `bun` (no regex manager needed);
+      // without it here that one would go into the monthly group without the Flatpak's Bun.
+      matchPackageNames: ["bun", "oven-sh/bun"],
       enabled: true,
       groupName: "Bun",
       sourceUrl: "https://github.com/oven-sh/bun",
diff --git a/packaging/toolbox.sh b/packaging/toolbox.sh
index 22fdebc..82587cf 100755
--- a/packaging/toolbox.sh
+++ b/packaging/toolbox.sh
@@ -8,7 +8,12 @@ toolbox run -c "$name" sudo dnf install -y \
   webkit2gtk4.1-devel openssl-devel curl wget file libayatana-appindicator-gtk3-devel librsvg2-devel \
   gcc gcc-c++ make patchelf unzip git just pipewire-utils rpm-build
 toolbox run -c "$name" bash -c 'command -v cargo || curl --proto "=https" --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y'
-# Bun, the version in app/package.json's packageManager (its installer needs unzip)
-bun_version=$(sed -n 's/.*"packageManager": "bun@\([0-9.]*\)".*/\1/p' "$(dirname "$0")/../app/package.json")
-toolbox run -c "$name" bash -c "command -v bun || curl -fsSL https://bun.sh/install | bash -s bun-v$bun_version"
+# Bun, the version in app/package.json's packageManager (what CI runs), read without jq or node;
+# installed unless that version is there already (the official installer takes the release tag
+# and needs unzip)
+bun_version=$(sed -n 's/.*"packageManager": *"bun@\([0-9][^"]*\)".*/\1/p' "$(dirname "$0")/../app/package.json")
+[[ -n "$bun_version" ]] || { echo "No Bun version in app/package.json (packageManager)." >&2; exit 1; }
+printf -v install_bun '[ "$(PATH="$HOME/.bun/bin:$PATH" bun --version 2>/dev/null)" = %q ] || curl -fsSL https://bun.sh/install | bash -s %q' \
+  "$bun_version" "bun-v$bun_version"
+toolbox run -c "$name" bash -c "$install_bun"
 echo "Done. Enter it with 'toolbox enter $name', then 'just setup && just'."