diff --git a/k8s/infra/forgejo-runner/templates/configmap.yaml b/k8s/infra/forgejo-runner/templates/configmap.yaml
new file mode 100644
index 0000000..81e193d
--- /dev/null
+++ b/k8s/infra/forgejo-runner/templates/configmap.yaml
@@ -0,0 +1,25 @@
+# act_runner (the forgejo-runner binary) ships no config.yaml by default, so
+# `forgejo-runner daemon` runs on its hardcoded defaults -- notably
+# container.valid_volumes: [] ("if the sequence is empty, no volumes can be
+# mounted"). Confirmed via `forgejo-runner generate-config` on this exact
+# image (code.forgejo.org/forgejo/runner:6) and by running the daemon against
+# a minimal override locally: a job container that requests any bind mount
+# (e.g. the dind mTLS certs at /docker-certs/client, needed for
+# `docker login`/build/push steps) is rejected outright with no default
+# config in place.
+#
+# Scoped narrowly to exactly the certs path, read-only. Not a wildcard
+# (valid_volumes: ['**']) -- that would let any workflow in any repo this
+# runner serves bind-mount arbitrary paths off the runner pod's filesystem
+# into a job container, which is a real widening of the CI trust boundary,
+# not just a convenience.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-config
+  namespace: {{ .Release.Namespace }}
+data:
+  config.yaml: |
+    container:
+      valid_volumes:
+        - /docker-certs/client
diff --git a/k8s/infra/forgejo-runner/templates/deployment.yaml b/k8s/infra/forgejo-runner/templates/deployment.yaml
index 67d88b4..b2552e5 100644
--- a/k8s/infra/forgejo-runner/templates/deployment.yaml
+++ b/k8s/infra/forgejo-runner/templates/deployment.yaml
@@ -56,7 +56,7 @@ spec:
       containers:
         - name: runner
           image: {{ .Values.runner.image.repository }}:{{ .Values.runner.image.tag }}
-          command: ["sh", "-c", "forgejo-runner daemon"]
+          command: ["sh", "-c", "forgejo-runner daemon --config /etc/forgejo-runner/config.yaml"]
           workingDir: /data
           env:
             - name: DOCKER_HOST
@@ -73,6 +73,9 @@ spec:
             - name: homelab-ca
               mountPath: /etc/ssl/certs/homelab-ca.pem
               subPath: ca.crt
+            - name: runner-config
+              mountPath: /etc/forgejo-runner
+              readOnly: true
           resources:
             {{- toYaml .Values.runner.resources | nindent 12 }}
 
@@ -115,3 +118,6 @@ spec:
           # The volumeMounts use subPath: ca.crt to project the single cert file.
           configMap:
             name: homelab-ca
+        - name: runner-config
+          configMap:
+            name: {{ .Release.Name }}-config