diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 19035b5..b6e0326 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -45,6 +45,10 @@ jobs:
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          # workingDirectory has no lockfile, so the action would infer npm and choke
+          # on bun's `workspace:*` deps. Force bun (handles workspace:*) and pin wrangler.
+          packageManager: bun
+          wranglerVersion: "4.95.0"
           workingDirectory: apps/api/cloudflare
           command: deploy
           secrets: |
@@ -70,4 +74,6 @@ jobs:
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          packageManager: bun
+          wranglerVersion: "4.95.0"
           command: pages deploy apps/web/dist --project-name=contextmem --branch=main