diff --git a/servers/legion/k8s/gitea-runner/buildkitd.yaml b/servers/legion/k8s/gitea-runner/buildkitd.yaml
index 4e18a65..b3241ae 100644
--- a/servers/legion/k8s/gitea-runner/buildkitd.yaml
+++ b/servers/legion/k8s/gitea-runner/buildkitd.yaml
@@ -1,7 +1,8 @@
 ---
-# BuildKit daemon — rootless image builder for CI runners.
-# Replaces the /var/run/docker.sock hostPath mount that gave containers
-# full root access to the Legion host node.
+# BuildKit daemon — privileged image builder for CI runners.
+# Runs as root with privileged=true in the isolated ci namespace.
+# Rootless mode (moby/buildkit:*-rootless) fails on k3s/containerd because
+# rootlesskit cannot share mount propagation on the container root fs.
 #
 # Runners connect via TCP: DOCKER_HOST=tcp://buildkitd.ci.svc.cluster.local:1234
 apiVersion: apps/v1
@@ -23,9 +24,8 @@ spec:
     spec:
       containers:
         - name: buildkitd
-          image: moby/buildkit:v0.19.0-rootless
+          image: moby/buildkit:v0.19.0
           args:
-            - --oci-worker-no-process-sandbox
             - --addr
             - tcp://0.0.0.0:1234
             - --addr
@@ -34,11 +34,7 @@ spec:
             - name: tcp
               containerPort: 1234
           securityContext:
-            seccompProfile:
-              type: Unconfined            # BuildKit rootless requires this
-            runAsUser: 1000
-            runAsGroup: 1000
-            allowPrivilegeEscalation: true  # required for newuidmap/newgidmap setuid binaries
+            privileged: true
           readinessProbe:
             exec:
               command: ["buildctl", "debug", "workers"]
@@ -53,7 +49,7 @@ spec:
               memory: 4Gi
           volumeMounts:
             - name: buildkit-storage
-              mountPath: /home/user/.local/share/buildkit
+              mountPath: /var/lib/buildkit
       volumes:
         - name: buildkit-storage
           emptyDir: {}