diff --git a/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml b/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
index 90ac4b7..7d4349f 100644
--- a/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
+++ b/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
@@ -64,6 +64,22 @@ gitea:
       TYPE: redis
       CONN_STR: redis://forgejo-redis.cicd.svc.cluster.local:6379/2
 
+    # Actions must be enabled globally, not just per-repo. Without this section
+    # app.ini carries no [actions] block at all and Forgejo never *creates* a
+    # workflow run — the API returns total_count: 0 for every repo even though
+    # each repo reports has_actions: true, the workflow file is on the default
+    # branch, and forgejo-runner has registered successfully with label
+    # [docker]. Registration does not require the dispatcher, so a healthy-
+    # looking runner sitting at "[poller 0] launched" with zero task pickups is
+    # the symptom of this being off, not of a bad workflow or a label mismatch.
+    #
+    # DEFAULT_ACTIONS_URL is left at its default (https://code.forgejo.org),
+    # which is where `uses: actions/checkout@v4` and friends resolve from. That
+    # requires egress from the runner; if it is ever blocked, pin the actions to
+    # local copies rather than turning this off.
+    actions:
+      ENABLED: true
+
 # Persistence (shared storage for repos)
 persistence:
   enabled: true