diff --git a/k8s/infra/forgejo-runner/Dockerfile.golang b/k8s/infra/forgejo-runner/Dockerfile.golang
new file mode 100644
index 0000000..7c80956
--- /dev/null
+++ b/k8s/infra/forgejo-runner/Dockerfile.golang
@@ -0,0 +1,16 @@
+FROM docker:27-cli
+
+# Install Node.js + build essentials (needed for GitHub Actions checkout@v4, etc.)
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+      nodejs \
+      npm \
+      git \
+      curl \
+      ca-certificates \
+      build-essential \
+      python3 && \
+    rm -rf /var/lib/apt/lists/*
+
+# Verify installations
+RUN docker --version && node --version && git --version
diff --git a/k8s/infra/forgejo-runner/Dockerfile.rust b/k8s/infra/forgejo-runner/Dockerfile.rust
new file mode 100644
index 0000000..59d66bf
--- /dev/null
+++ b/k8s/infra/forgejo-runner/Dockerfile.rust
@@ -0,0 +1,20 @@
+FROM docker:27-cli
+
+# Install Node.js + build essentials (needed for GitHub Actions checkout@v4, etc.)
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+      nodejs \
+      npm \
+      git \
+      curl \
+      ca-certificates \
+      build-essential \
+      python3 && \
+    rm -rf /var/lib/apt/lists/*
+
+# Install Rust
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && \
+    . $HOME/.cargo/env
+
+# Verify installations
+RUN docker --version && node --version && git --version && rustc --version
diff --git a/k8s/infra/forgejo-runner/values-rust.yaml b/k8s/infra/forgejo-runner/values-rust.yaml
index b0c00d2..bd05dbc 100644
--- a/k8s/infra/forgejo-runner/values-rust.yaml
+++ b/k8s/infra/forgejo-runner/values-rust.yaml
@@ -2,20 +2,16 @@
 # runner instance. Only runner.name and runner.labels differ -- everything
 # else (image, dind, persistence, tolerations, nodeSelector) is shared.
 #
-# Use docker:27-cli instead of rust:1.83-bookworm because:
-#   - Needs Node.js for GitHub Actions (actions/checkout@v4, etc.)
-#   - Has docker CLI + git + full dev tools
-#   - rust:1.83-bookworm lacks Node.js (causes action failures)
-#
-# docker:27-cli verified: docker manifest inspect docker:27-cli ✓
+# Custom image: docker:27-cli + Node.js + Rust + build tools
+#   - Node.js for GitHub Actions (actions/checkout@v4, etc.)
+#   - Docker CLI for container builds
+#   - Rust toolchain (via rustup)
+#   - Build essentials
 runner:
   name: rust-runner
-  labels: "rust:docker://docker:27-cli"
+  labels: "rust:docker://forgejo.riotpiao.com/rock/forgejo-runner-rust:latest"
+
 
-persistence:
-  reg:
-    storageClass: longhorn
-    size: 20Gi
 
 # GC CronJob renders only from the default (golang) values to avoid duplicates
 gc:
diff --git a/k8s/infra/forgejo-runner/values.yaml b/k8s/infra/forgejo-runner/values.yaml
index 88de7d1..0f1587b 100644
--- a/k8s/infra/forgejo-runner/values.yaml
+++ b/k8s/infra/forgejo-runner/values.yaml
@@ -3,15 +3,12 @@ runner:
     repository: code.forgejo.org/forgejo/runner
     tag: "6"          # pin exact release before apply
   name: golang-runner
-  # Use docker:27-cli instead of golang:1.26-bookworm because:
-  #   - Needs Node.js for GitHub Actions (actions/checkout@v4, etc.)
-  #   - Has docker CLI + git + golang + all build tools
-  #   - golang:1.26-bookworm lacks Node.js (causes action failures)
-  # docker:27-cli includes Go toolchain via base debian + additional packages
-  # Verified tag: docker manifest inspect docker:27-cli ✓
-  labels: "golang:docker://docker:27-cli"
-  # In-cluster Service (:3000) — direct, avoids the ingress/public-hostname hop
-  # (the public URL is :443 which forgejo doesn't serve; runner got i/o timeout).
+  # Custom image: docker:27-cli + Node.js + Go + build tools
+  #   - Node.js for GitHub Actions (actions/checkout@v4, etc.)
+  #   - Docker CLI for container builds
+  #   - Go toolchain
+  #   - Build essentials
+  labels: "golang:docker://forgejo.riotpiao.com/rock/forgejo-runner-golang:latest"
   forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000
   # tokenSecret: name of the K8s Secret that holds the runner registration token
   # created automatically by the helmfile presync hook (see helmfile.yaml.gotmpl)