diff --git a/servers/legion/apps/gitea-runner.yaml b/servers/legion/apps/gitea-runner.yaml
index ff58b88..c68ecda 100644
--- a/servers/legion/apps/gitea-runner.yaml
+++ b/servers/legion/apps/gitea-runner.yaml
@@ -15,9 +15,6 @@ spec:
       labels:
         app: gitea-runner
     spec:
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
       initContainers:
         - name: register
           image: gitea/act_runner:latest
@@ -29,18 +26,17 @@ spec:
                 --instance "$GITEA_INSTANCE_URL" \
                 --token "$GITEA_RUNNER_REGISTRATION_TOKEN" \
                 --name legion \
-                --labels "self-hosted,linux,x64,legion" \
+                --labels "self-hosted:docker://registry.neuralplatform.ai/pantheon-ci:latest,linux:docker://registry.neuralplatform.ai/pantheon-ci:latest,x64:docker://registry.neuralplatform.ai/pantheon-ci:latest,legion:docker://registry.neuralplatform.ai/pantheon-ci:latest" \
                 --no-interactive
               cat > /data/config.yaml << 'EOF'
               runner:
                 capacity: 2
                 timeout: 3h
-              host:
-                workdir_parent: /data/workspace
+              container:
+                network: host
+                docker_host: "unix:///var/run/docker.sock"
+                force_pull: false
               EOF
-          env:
-            - name: HOME
-              value: /home/will
           envFrom:
             - secretRef:
                 name: gitea-runner-secret
@@ -52,11 +48,6 @@ spec:
           image: gitea/act_runner:latest
           workingDir: /data
           command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
-          env:
-            - name: HOME
-              value: /home/will
-            - name: PATH
-              value: /home/will/.local/bin:/usr/local/bin:/usr/bin:/bin
           envFrom:
             - secretRef:
                 name: gitea-runner-secret
@@ -65,24 +56,6 @@ spec:
               mountPath: /data
             - name: docker-sock
               mountPath: /var/run/docker.sock
-            - name: usr-local-bin
-              mountPath: /usr/local/bin
-              readOnly: true
-            - name: usr-bin
-              mountPath: /usr/bin
-              readOnly: true
-            - name: usr-local-lib
-              mountPath: /usr/local/lib
-              readOnly: true
-            - name: usr-lib-python3
-              mountPath: /usr/lib/python3
-              readOnly: true
-            - name: usr-lib-python312
-              mountPath: /usr/lib/python3.12
-              readOnly: true
-            - name: home-will-local
-              mountPath: /home/will/.local
-              readOnly: true
           resources:
             requests:
               memory: 512Mi
@@ -97,21 +70,3 @@ spec:
           hostPath:
             path: /var/run/docker.sock
             type: Socket
-        - name: usr-local-bin
-          hostPath:
-            path: /usr/local/bin
-        - name: usr-bin
-          hostPath:
-            path: /usr/bin
-        - name: usr-local-lib
-          hostPath:
-            path: /usr/local/lib
-        - name: usr-lib-python3
-          hostPath:
-            path: /usr/lib/python3
-        - name: usr-lib-python312
-          hostPath:
-            path: /usr/lib/python3.12
-        - name: home-will-local
-          hostPath:
-            path: /home/will/.local
diff --git a/servers/legion/k8s/registry/ingress.yaml b/servers/legion/k8s/registry/ingress.yaml
index fdb782e..2082031 100644
--- a/servers/legion/k8s/registry/ingress.yaml
+++ b/servers/legion/k8s/registry/ingress.yaml
@@ -1,4 +1,17 @@
 ---
+# Middleware: allow unlimited body size for Docker image layer uploads
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: registry-chunked
+  namespace: registry
+spec:
+  buffering:
+    maxRequestBodyBytes: 0
+    maxResponseBodyBytes: 0
+    memRequestBodyBytes: 0
+    retryExpression: ""
+---
 # Docker registry ingress with chunked upload middleware
 apiVersion: networking.k8s.io/v1
 kind: Ingress