diff --git a/VERSIONS b/VERSIONS
index 8fa8ab5..527f8e3 100644
--- a/VERSIONS
+++ b/VERSIONS
@@ -94,7 +94,10 @@ IMAGE_CI=foundation-ci:latest
 # -----------------------------------------------------------------------------
 
 # --- orchestration toolchain ---
-TOOL_PULUMI_MIN=3.140.0
+# 3.149 is the floor for the `packagemanager: bun` project option (bootstrap/
+# Pulumi.yaml); older CLIs reject "bun". The foundation-ci image pins a concrete
+# version >= this (containers/ci-image/Dockerfile PULUMI_VERSION).
+TOOL_PULUMI_MIN=3.149.0
 TOOL_BUN_MIN=1.1.0
 TOOL_NODE_MIN=20.0.0
 
diff --git a/containers/ci-image/Dockerfile b/containers/ci-image/Dockerfile
index 4269dd9..00dc17a 100644
--- a/containers/ci-image/Dockerfile
+++ b/containers/ci-image/Dockerfile
@@ -10,7 +10,10 @@
 # operation (PULUMI_CONFIG_PASSPHRASE + SSH key arrive as CI secrets/env).
 FROM node:20-bookworm
 
-ARG PULUMI_VERSION=3.145.0
+# Pulumi >= 3.149 is required: the project pins `packagemanager: bun`
+# (bootstrap/Pulumi.yaml) and older CLIs reject "bun" as an unknown package
+# manager. Matches the operator's CLI line for preview parity (TOOL_PULUMI_MIN).
+ARG PULUMI_VERSION=3.243.0
 ARG VAULT_VERSION=1.18.5
 ARG MC_RELEASE=RELEASE.2025-04-03T17-07-56Z
 ARG TARGETARCH=amd64