diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a83cb86fea..3a25a32403 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -16,6 +16,16 @@ updates:
     # aes-gcm 0.11 lands and the whole AEAD surface can move in one PR.
     # Patch bumps still flow through.
     ignore:
+      # bson must stay on the major that `mongodb` re-exports (mongodb 3.x
+      # -> bson 2.x): perry-stdlib/perry-ext-mongodb build `bson::Document`s
+      # and pass them into mongodb APIs, so a solo bson major bump splits
+      # the graph into TWO bson versions and every mongodb call fails E0308
+      # ("expected mongodb::bson::Document, found bson::Document") — but
+      # only in the feature-gated bundled-mongodb builds (parity/smokes),
+      # never default cargo-test. Bump bson together with a mongodb major
+      # that re-exports it (#5872).
+      - dependency-name: "bson"
+        update-types: ["version-update:semver-major"]
       - dependency-name: "aes"
         update-types: ["version-update:semver-minor"]
       - dependency-name: "aes-gcm"
diff --git a/Cargo.lock b/Cargo.lock
index 08e73b8dc7..f895d2bf24 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -840,27 +840,6 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "bson"
-version = "3.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3f109694c4f45353972af96bf97d8a057f82e2d6e496457f4d135b9867a518c"
-dependencies = [
- "ahash 0.8.12",
- "base64",
- "bitvec",
- "getrandom 0.3.4",
- "hex",
- "indexmap",
- "js-sys",
- "rand 0.9.4",
- "serde_bytes",
- "simdutf8",
- "thiserror 2.0.18",
- "time",
- "uuid",
-]
-
 [[package]]
 name = "built"
 version = "0.8.1"
@@ -4603,7 +4582,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8da0cd419a51a5fb44819e290fbdb0665a54f21dead8923446a799c7f4d26ad9"
 dependencies = [
- "bson 2.15.0",
+ "bson",
  "mongocrypt-sys",
  "once_cell",
  "serde",
@@ -4623,7 +4602,7 @@ checksum = "276ba0cd571553d1f6936c6f180964776ece6ab7507dc8765f8a9c9c49d8cd00"
 dependencies = [
  "base64",
  "bitflags 2.12.1",
- "bson 2.15.0",
+ "bson",
  "derive-where",
  "derive_more",
  "futures-core",
@@ -5797,7 +5776,7 @@ dependencies = [
 name = "perry-ext-mongodb"
 version = "0.5.1217"
 dependencies = [
- "bson 3.1.0",
+ "bson",
  "futures-util",
  "mongodb",
  "perry-ffi",
@@ -6028,7 +6007,7 @@ dependencies = [
  "base64",
  "bcrypt",
  "brotli",
- "bson 3.1.0",
+ "bson",
  "bytes",
  "cbc",
  "chacha20poly1305",
diff --git a/crates/perry-ext-mongodb/Cargo.toml b/crates/perry-ext-mongodb/Cargo.toml
index 408618e1aa..78d799781b 100644
--- a/crates/perry-ext-mongodb/Cargo.toml
+++ b/crates/perry-ext-mongodb/Cargo.toml
@@ -11,7 +11,7 @@ crate-type = ["staticlib", "rlib"]
 [dependencies]
 perry-ffi.workspace = true
 mongodb = { version = "3.7", default-features = false, features = ["compat-3-0-0", "rustls-tls", "dns-resolver"] }
-bson = "3.1"
+bson = "2.15"
 tokio = { workspace = true }
 futures-util = "0.3"
 serde_json = "1"
diff --git a/crates/perry-stdlib/Cargo.toml b/crates/perry-stdlib/Cargo.toml
index e8e4fbcd29..d2cf5a6476 100644
--- a/crates/perry-stdlib/Cargo.toml
+++ b/crates/perry-stdlib/Cargo.toml
@@ -378,7 +378,7 @@ rustls-pemfile = { version = "2", optional = true }
 sqlx = { version = "0.9.0", default-features = false, features = ["runtime-tokio", "mysql", "postgres", "chrono"], optional = true }
 redis = { version = "1.2", features = ["tokio-comp", "connection-manager"], optional = true }
 mongodb = { version = "3.7", default-features = false, features = ["compat-3-0-0", "rustls-tls", "dns-resolver"], optional = true }
-bson = { version = "3.1", optional = true }
+bson = { version = "2.15", optional = true }
 rusqlite = { version = "0.37", features = ["bundled", "column_decltype", "limits", "session"], optional = true }
 
 # Crypto