diff --git a/k8s/security/ci-cd/charts/forgejo-runner/templates/deployment.yaml b/k8s/security/ci-cd/charts/forgejo-runner/templates/deployment.yaml
index 49394ce..de33f29 100644
--- a/k8s/security/ci-cd/charts/forgejo-runner/templates/deployment.yaml
+++ b/k8s/security/ci-cd/charts/forgejo-runner/templates/deployment.yaml
@@ -17,6 +17,10 @@ spec:
       labels:
         app: {{ .Release.Name }}
     spec:
+      # runner image runs as UID 1000; fsGroup makes the Longhorn /data PVC
+      # group-writable so `register` can write /data/.runner (else permission denied).
+      securityContext:
+        fsGroup: 1000
       tolerations:
         {{- toYaml .Values.tolerations | nindent 8 }}
       {{- with .Values.nodeSelector }}