diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 77aab51..0e085b3 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -5,11 +5,10 @@ on:
     paths:
       - "agent/**"
       - ".gitea/workflows/build.yml"
+  workflow_dispatch: {}
 
 jobs:
   build-and-push:
-    # If your act_runner advertises a different label than "docker" (check its
-    # config.yaml / GITEA_RUNNER_LABELS), update this to match.
     runs-on: docker
     steps:
       - uses: actions/checkout@v4
diff --git a/act-runner-config.yaml b/act-runner-config.yaml
new file mode 100644
index 0000000..0a8cf28
--- /dev/null
+++ b/act-runner-config.yaml
@@ -0,0 +1,6 @@
+# Mounts the host Docker socket into every job container act_runner creates, so
+# `docker build`/`docker push` work inside workflow steps (Docker-outside-of-Docker).
+# This is a runner-admin-controlled default (not something a workflow author can
+# request itself), which is the safer of the two ways act_runner supports this.
+container:
+  options: "-v /var/run/docker.sock:/var/run/docker.sock"
diff --git a/docker-compose.yml b/docker-compose.yml
index d545743..215762e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -84,10 +84,14 @@ services:
       GITEA_INSTANCE_URL: ${GITEA_URL}
       GITEA_RUNNER_REGISTRATION_TOKEN: ${ACT_RUNNER_REGISTRATION_TOKEN}
       GITEA_RUNNER_NAME: gitops-vps-runner
-      GITEA_RUNNER_LABELS: docker:docker://node:22-bookworm
+      # catthehacker/ubuntu:act-latest is the standard job-container image for
+      # act/act_runner — includes git + docker CLI, which job steps need.
+      GITEA_RUNNER_LABELS: docker:docker://catthehacker/ubuntu:act-latest
+      CONFIG_FILE: /etc/act_runner/config.yaml
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - act_runner_data:/data
+      - ./act-runner-config.yaml:/etc/act_runner/config.yaml:ro
     networks:
       - web