diff --git a/.github/workflows/kms-auth-eth-bun.yml b/.github/workflows/kms-auth-eth-bun.yml
index 41049365e..bd2d94655 100644
--- a/.github/workflows/kms-auth-eth-bun.yml
+++ b/.github/workflows/kms-auth-eth-bun.yml
@@ -50,7 +50,7 @@ jobs:
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           # Keep in step with the base image in the Dockerfile.
-          bun-version: 1.4.2
+          bun-version: 1.4.4
           # A release build must not restore a cache an untrusted run wrote.
           no-cache: true
 
diff --git a/dstack/kms/auth-eth-bun/Dockerfile b/dstack/kms/auth-eth-bun/Dockerfile
index b39c94c75..e5e96bae2 100644
--- a/dstack/kms/auth-eth-bun/Dockerfile
+++ b/dstack/kms/auth-eth-bun/Dockerfile
@@ -4,12 +4,12 @@
 
 # Built from this directory, so the image carries exactly the checked-out
 # source and lockfile rather than a clone fetched at build time.
-FROM oven/bun:1.4.2-alpine@sha256:d888c0ae6c86d7866ff10c5aafdd9077b36aee6455b33dd270fb93c0dd5cef6f AS deps
+FROM oven/bun:1.4.4-alpine@sha256:4cf82f5686b196504fe119db3fcd9185b191f82ece82c40680e597228ec6070a AS deps
 WORKDIR /app
 COPY package.json bun.lock ./
 RUN bun install --frozen-lockfile --production --ignore-scripts
 
-FROM oven/bun:1.4.2-alpine@sha256:d888c0ae6c86d7866ff10c5aafdd9077b36aee6455b33dd270fb93c0dd5cef6f
+FROM oven/bun:1.4.4-alpine@sha256:4cf82f5686b196504fe119db3fcd9185b191f82ece82c40680e597228ec6070a
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY package.json index.ts ./