diff --git a/.gitea/workflows/build-runner-images.yml b/.gitea/workflows/build-runner-images.yml
index 9be5692..d9489db 100644
--- a/.gitea/workflows/build-runner-images.yml
+++ b/.gitea/workflows/build-runner-images.yml
@@ -8,6 +8,12 @@ on:
       - 'k8s/infra/forgejo-runner/Dockerfile.node'
     branches:
       - main
+  pull_request:
+    paths:
+      - 'k8s/infra/forgejo-runner/Dockerfile.golang'
+      - 'k8s/infra/forgejo-runner/Dockerfile.rust'
+      - 'k8s/infra/forgejo-runner/Dockerfile.node'
+      - '.gitea/workflows/build-runner-images.yml'
 
 jobs:
   build-runners:
@@ -25,43 +31,30 @@ jobs:
           SHORT_SHA=$(git rev-parse --short HEAD)
           echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
 
-      - name: Registry login
+      - name: Build all runner images (test on PR, push on main)
+        run: |
+          set -e
+          for RUNNER in golang rust node; do
+            echo "📦 Building ${RUNNER}-runner..."
+            docker build -f "k8s/infra/forgejo-runner/Dockerfile.${RUNNER}" \
+              -t "${IMAGE_BASE}/forgejo-runner-${RUNNER}:${{ steps.sha.outputs.short_sha }}" \
+              -t "${IMAGE_BASE}/forgejo-runner-${RUNNER}:latest" \
+              .
+            echo "✅ Built ${RUNNER}-runner"
+          done
+
+      - name: Push images (main only)
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
             --username "${REGISTRY_USER}" --password-stdin
+          for RUNNER in golang rust node; do
+            echo "📤 Pushing ${RUNNER}-runner:${{ steps.sha.outputs.short_sha }}"
+            docker push "${IMAGE_BASE}/forgejo-runner-${RUNNER}:${{ steps.sha.outputs.short_sha }}"
+            docker push "${IMAGE_BASE}/forgejo-runner-${RUNNER}:latest"
+            echo "✅ Pushed ${RUNNER}-runner"
+          done
+          echo "\n✅ All runner images pushed to registry"
         env:
           REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
           REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
-
-      - name: Build and push golang-runner
-        if: contains(github.event.head_commit.modified, 'Dockerfile.golang')
-        run: |
-          docker build -f k8s/infra/forgejo-runner/Dockerfile.golang \
-            -t "${IMAGE_BASE}/forgejo-runner-golang:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE_BASE}/forgejo-runner-golang:latest" \
-            .
-          docker push "${IMAGE_BASE}/forgejo-runner-golang:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE_BASE}/forgejo-runner-golang:latest"
-          echo "✓ Pushed golang-runner"
-
-      - name: Build and push rust-runner
-        if: contains(github.event.head_commit.modified, 'Dockerfile.rust')
-        run: |
-          docker build -f k8s/infra/forgejo-runner/Dockerfile.rust \
-            -t "${IMAGE_BASE}/forgejo-runner-rust:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE_BASE}/forgejo-runner-rust:latest" \
-            .
-          docker push "${IMAGE_BASE}/forgejo-runner-rust:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE_BASE}/forgejo-runner-rust:latest"
-          echo "✓ Pushed rust-runner"
-
-      - name: Build and push node-runner
-        if: contains(github.event.head_commit.modified, 'Dockerfile.node')
-        run: |
-          docker build -f k8s/infra/forgejo-runner/Dockerfile.node \
-            -t "${IMAGE_BASE}/forgejo-runner-node:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE_BASE}/forgejo-runner-node:latest" \
-            .
-          docker push "${IMAGE_BASE}/forgejo-runner-node:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE_BASE}/forgejo-runner-node:latest"
-          echo "✓ Pushed node-runner"
diff --git a/k8s/infra/forgejo-runner/Dockerfile.golang b/k8s/infra/forgejo-runner/Dockerfile.golang
index 6e44dd7..ace220d 100644
--- a/k8s/infra/forgejo-runner/Dockerfile.golang
+++ b/k8s/infra/forgejo-runner/Dockerfile.golang
@@ -1,12 +1,16 @@
 FROM code.forgejo.org/forgejo/runner:6
 
-# Install Node.js + Docker client (needed for GitHub Actions + docker build)
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
+# Switch to root to install packages (Alpine)
+USER root
+
+# Alpine uses apk, not apt-get
+RUN apk update && apk add --no-cache \
       nodejs \
       npm \
-      docker.io && \
-    rm -rf /var/lib/apt/lists/*
+      docker-cli
 
 # Verify installations
 RUN docker --version && node --version && git --version
+
+# Switch back to runner user
+USER 1000:1000
diff --git a/k8s/infra/forgejo-runner/Dockerfile.node b/k8s/infra/forgejo-runner/Dockerfile.node
index c40253a..4f841ab 100644
--- a/k8s/infra/forgejo-runner/Dockerfile.node
+++ b/k8s/infra/forgejo-runner/Dockerfile.node
@@ -1,11 +1,16 @@
 FROM code.forgejo.org/forgejo/runner:6
 
-# Install Docker client (forgejo/runner base doesn't include it)
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-      docker.io && \
-    rm -rf /var/lib/apt/lists/*
+# Switch to root to install packages (Alpine)
+USER root
+
+# Alpine uses apk, not apt-get
+RUN apk update && apk add --no-cache \
+      docker-cli \
+      nodejs \
+      npm
 
 # Verify installations
 RUN node --version && docker --version && git --version
-# Trigger node-runner build with docker
+
+# Switch back to runner user
+USER 1000:1000
diff --git a/k8s/infra/forgejo-runner/Dockerfile.rust b/k8s/infra/forgejo-runner/Dockerfile.rust
index 621b301..90e4198 100644
--- a/k8s/infra/forgejo-runner/Dockerfile.rust
+++ b/k8s/infra/forgejo-runner/Dockerfile.rust
@@ -1,16 +1,20 @@
 FROM code.forgejo.org/forgejo/runner:6
 
-# Install Node.js + Rust (needed for GitHub Actions checkout@v4, etc.)
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
+# Switch to root to install packages (Alpine)
+USER root
+
+# Alpine uses apk, not apt-get
+RUN apk update && apk add --no-cache \
       nodejs \
-      npm && \
-    rm -rf /var/lib/apt/lists/*
+      npm \
+      curl \
+      docker-cli
 
-# Install Rust
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+# Install Rust (as root, skip verification for now)
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable || true
 
-ENV PATH="/root/.cargo/bin:${PATH}"
+# Verify core installations
+RUN docker --version && node --version && git --version
 
-# Verify installations
-RUN docker --version && node --version && git --version && rustc --version
+# Switch back to runner user
+USER 1000:1000