diff --git a/servers/legion/apps/gitea-runner.yaml b/servers/legion/apps/gitea-runner.yaml
index 122baf5..5d01b95 100644
--- a/servers/legion/apps/gitea-runner.yaml
+++ b/servers/legion/apps/gitea-runner.yaml
@@ -26,8 +26,20 @@ spec:
                 --instance "$GITEA_INSTANCE_URL" \
                 --token "$GITEA_RUNNER_REGISTRATION_TOKEN" \
                 --name legion \
-                --labels self-hosted,linux,x64,legion \
+                --labels "self-hosted:docker://ghcr.io/catthehacker/ubuntu:act-22.04,linux:docker://ghcr.io/catthehacker/ubuntu:act-22.04,x64:docker://ghcr.io/catthehacker/ubuntu:act-22.04,legion:docker://ghcr.io/catthehacker/ubuntu:act-22.04" \
                 --no-interactive
+              # Write runner config enabling docker socket passthrough for build jobs
+              cat > /data/config.yaml << 'EOF'
+              runner:
+                capacity: 2
+                envs: {}
+                timeout: 3h
+              container:
+                network: bridge
+                options: "-v /var/run/docker.sock:/var/run/docker.sock"
+                docker_host: "unix:///var/run/docker.sock"
+                force_pull: false
+              EOF
           envFrom:
             - secretRef:
                 name: gitea-runner-secret
@@ -38,7 +50,7 @@ spec:
         - name: runner
           image: gitea/act_runner:latest
           workingDir: /data
-          command: ["act_runner", "daemon"]
+          command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
           envFrom:
             - secretRef:
                 name: gitea-runner-secret