diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 2764e5d..56ba865 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -40,7 +40,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.13
+          bun-version: 1.3.1
 
       - name: Install system dependencies (Linux)
         if: matrix.os == 'linux'
diff --git a/src/sandbox/sandbox-utils.ts b/src/sandbox/sandbox-utils.ts
index 63ce211..8105612 100644
--- a/src/sandbox/sandbox-utils.ts
+++ b/src/sandbox/sandbox-utils.ts
@@ -381,10 +381,13 @@ export function generateProxyEnvVars(
     // AWS CLI - uses standard HTTPS_PROXY (v2 supports it well)
     // AWS CLI v2 respects HTTPS_PROXY which we already set above
 
-    // Google Cloud SDK - has specific proxy settings
-    // Use HTTPS proxy to match other HTTP-based tools
+    // Google Cloud SDK - has specific proxy settings.
+    // proxy/type names the protocol the *proxy* speaks, not the traffic it
+    // tunnels. Our HTTP CONNECT proxy carries TLS to Google APIs, so the
+    // correct value is "http" (gcloud only accepts http, http_no_tunnel,
+    // socks4, socks5; "https" is rejected at startup).
     if (httpProxyPort) {
-      envVars.push(`CLOUDSDK_PROXY_TYPE=https`)
+      envVars.push(`CLOUDSDK_PROXY_TYPE=http`)
       envVars.push(`CLOUDSDK_PROXY_ADDRESS=localhost`)
       envVars.push(`CLOUDSDK_PROXY_PORT=${httpProxyPort}`)
     }
diff --git a/test/sandbox/proxy-env-vars.test.ts b/test/sandbox/proxy-env-vars.test.ts
new file mode 100644
index 0000000..075e48e
--- /dev/null
+++ b/test/sandbox/proxy-env-vars.test.ts
@@ -0,0 +1,22 @@
+import { describe, it, expect } from 'bun:test'
+import { generateProxyEnvVars } from '../../src/sandbox/sandbox-utils.js'
+
+describe('generateProxyEnvVars', () => {
+  it('sets CLOUDSDK_PROXY_TYPE to http (gcloud rejects "https")', () => {
+    // gcloud's proxy/type only accepts http, http_no_tunnel, socks4, socks5.
+    // Our local proxy is an HTTP CONNECT proxy regardless of the traffic it
+    // tunnels, so the value must be "http" — see issue #151.
+    const env = generateProxyEnvVars(3128, 1080)
+
+    expect(env).toContain('CLOUDSDK_PROXY_TYPE=http')
+    expect(env).toContain('CLOUDSDK_PROXY_ADDRESS=localhost')
+    expect(env).toContain('CLOUDSDK_PROXY_PORT=3128')
+    expect(env).not.toContain('CLOUDSDK_PROXY_TYPE=https')
+  })
+
+  it('omits CLOUDSDK_PROXY_* when no HTTP proxy port is configured', () => {
+    const env = generateProxyEnvVars(undefined, 1080)
+
+    expect(env.some(v => v.startsWith('CLOUDSDK_PROXY_'))).toBe(false)
+  })
+})