diff --git a/servers/legion/k8s/gitea-runner/buildkitd.yaml b/servers/legion/k8s/gitea-runner/buildkitd.yaml
index 7abb889..4e18a65 100644
--- a/servers/legion/k8s/gitea-runner/buildkitd.yaml
+++ b/servers/legion/k8s/gitea-runner/buildkitd.yaml
@@ -35,9 +35,10 @@ spec:
               containerPort: 1234
           securityContext:
             seccompProfile:
-              type: Unconfined       # BuildKit rootless requires this
+              type: Unconfined            # BuildKit rootless requires this
             runAsUser: 1000
             runAsGroup: 1000
+            allowPrivilegeEscalation: true  # required for newuidmap/newgidmap setuid binaries
           readinessProbe:
             exec:
               command: ["buildctl", "debug", "workers"]