diff --git a/k8s/argocd/apps/30-security.yaml b/k8s/argocd/apps/30-security.yaml
index 53e9d96..a1d4d3d 100644
--- a/k8s/argocd/apps/30-security.yaml
+++ b/k8s/argocd/apps/30-security.yaml
@@ -152,6 +152,13 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+    argocd-image-updater.argoproj.io/image-list: runner=forgejo.riotpiao.com/rock/forgejo-runner-golang
+    argocd-image-updater.argoproj.io/runner.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/runner.allow-tags: regexp:^[0-9a-f]{7}$|^latest$|^v[0-9]+$
+    argocd-image-updater.argoproj.io/runner.helm.image-name: runner.image.repository
+    argocd-image-updater.argoproj.io/runner.helm.image-tag: runner.image.tag
+    argocd-image-updater.argoproj.io/write-back-method: git
+    argocd-image-updater.argoproj.io/git-branch: main
 spec:
   project: homelab
   source:
@@ -173,6 +180,13 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+    argocd-image-updater.argoproj.io/image-list: runner=forgejo.riotpiao.com/rock/forgejo-runner-node
+    argocd-image-updater.argoproj.io/runner.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/runner.allow-tags: regexp:^[0-9a-f]{7}$|^latest$|^v[0-9]+$
+    argocd-image-updater.argoproj.io/runner.helm.image-name: runner.image.repository
+    argocd-image-updater.argoproj.io/runner.helm.image-tag: runner.image.tag
+    argocd-image-updater.argoproj.io/write-back-method: git
+    argocd-image-updater.argoproj.io/git-branch: main
 spec:
   project: homelab
   source:
@@ -197,6 +211,13 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+    argocd-image-updater.argoproj.io/image-list: runner=forgejo.riotpiao.com/rock/forgejo-runner-rust
+    argocd-image-updater.argoproj.io/runner.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/runner.allow-tags: regexp:^[0-9a-f]{7}$|^latest$|^v[0-9]+$
+    argocd-image-updater.argoproj.io/runner.helm.image-name: runner.image.repository
+    argocd-image-updater.argoproj.io/runner.helm.image-tag: runner.image.tag
+    argocd-image-updater.argoproj.io/write-back-method: git
+    argocd-image-updater.argoproj.io/git-branch: main
 spec:
   project: homelab
   source:
diff --git a/k8s/infra/forgejo-runner/values-node.yaml b/k8s/infra/forgejo-runner/values-node.yaml
index 9c130e3..3cd17af 100644
--- a/k8s/infra/forgejo-runner/values-node.yaml
+++ b/k8s/infra/forgejo-runner/values-node.yaml
@@ -5,6 +5,9 @@
 # node:22-bookworm ships Node natively. Docker client installed via workflow step if needed.
 # (homelab has no CI; custom runner images built manually if desired)
 runner:
+  image:
+    repository: forgejo.riotpiao.com/rock/forgejo-runner-node
+    tag: "latest"  # Image Updater tracks and updates this
   name: node-runner
   # Custom image: node:22-bookworm + docker.io pre-installed
   labels: "node:docker://forgejo.riotpiao.com/rock/forgejo-runner-node:latest"
diff --git a/k8s/infra/forgejo-runner/values-rust.yaml b/k8s/infra/forgejo-runner/values-rust.yaml
index bd05dbc..e296cef 100644
--- a/k8s/infra/forgejo-runner/values-rust.yaml
+++ b/k8s/infra/forgejo-runner/values-rust.yaml
@@ -8,6 +8,9 @@
 #   - Rust toolchain (via rustup)
 #   - Build essentials
 runner:
+  image:
+    repository: forgejo.riotpiao.com/rock/forgejo-runner-rust
+    tag: "latest"  # Image Updater tracks and updates this
   name: rust-runner
   labels: "rust:docker://forgejo.riotpiao.com/rock/forgejo-runner-rust:latest"
 
diff --git a/k8s/infra/forgejo-runner/values.yaml b/k8s/infra/forgejo-runner/values.yaml
index 0f1587b..8098826 100644
--- a/k8s/infra/forgejo-runner/values.yaml
+++ b/k8s/infra/forgejo-runner/values.yaml
@@ -1,7 +1,7 @@
 runner:
   image:
-    repository: code.forgejo.org/forgejo/runner
-    tag: "6"          # pin exact release before apply
+    repository: forgejo.riotpiao.com/rock/forgejo-runner-golang
+    tag: "latest"  # Image Updater tracks and updates this
   name: golang-runner
   # Custom image: docker:27-cli + Node.js + Go + build tools
   #   - Node.js for GitHub Actions (actions/checkout@v4, etc.)