diff --git a/ansible/inventory/group_vars/services_servers/forgejo_runner.yaml b/ansible/inventory/group_vars/services_servers/forgejo_runner.yaml
index 4b78089..a4d04f3 100644
--- a/ansible/inventory/group_vars/services_servers/forgejo_runner.yaml
+++ b/ansible/inventory/group_vars/services_servers/forgejo_runner.yaml
@@ -3,8 +3,14 @@
 
 # Runner version and settings
 forgejo_runner_version: "11"
-forgejo_runner_capacity: 1
+forgejo_runner_capacity: 4
 forgejo_runner_timeout: 3h
+
+# Image behind the nix-latest label. Jobs mount a nix-store volume over
+# /nix, seeded from this image on first use; the image's /bin/sh and
+# /etc/nix/nix.conf link into that store, so a volume from another
+# version breaks them. Bumping this also switches to a fresh volume.
+forgejo_runner_nix_version: "2.35.3"
 forgejo_runner_token: "{{ vault_forgejo_runner_token }}"
 
 # Runner installation path
diff --git a/ansible/roles/forgejo_runner/templates/config.yaml.j2 b/ansible/roles/forgejo_runner/templates/config.yaml.j2
index fdf99bd..b24ad71 100644
--- a/ansible/roles/forgejo_runner/templates/config.yaml.j2
+++ b/ansible/roles/forgejo_runner/templates/config.yaml.j2
@@ -28,6 +28,7 @@ runner:
     - "python-3.11:docker://python:3.11"
     - "python-3.12:docker://python:3.12"
     - "alpine-latest:docker://alpine:latest"
+    - "nix-latest:docker://nixos/nix:{{ forgejo_runner_nix_version }}"
 
 cache:
   enabled: true
@@ -35,9 +36,13 @@ cache:
   dir: ""
 
 container:
-  network: "host"
+  # "" so each workflow gets a bridge network; services (Postgres) need it.
+  network: ""
   enable_ipv6: false
   privileged: false
-  docker_host: "-"
+  options: "-v nix-store-{{ forgejo_runner_nix_version }}:/nix"
+  valid_volumes:
+    - '**'
+  docker_host: "automount"
   force_pull: false
   force_rebuild: false
diff --git a/ansible/roles/forgejo_runner/templates/docker-compose.yml.j2 b/ansible/roles/forgejo_runner/templates/docker-compose.yml.j2
index c4f6855..1f9bd17 100644
--- a/ansible/roles/forgejo_runner/templates/docker-compose.yml.j2
+++ b/ansible/roles/forgejo_runner/templates/docker-compose.yml.j2
@@ -1,13 +1,16 @@
+name: forgejo-runner
+
 services:
   forgejo-runner:
-    image: code.forgejo.org/forgejo/runner:{{ forgejo_runner_version }}
     container_name: forgejo-runner
+    image: code.forgejo.org/forgejo/runner:{{ forgejo_runner_version }}
     restart: unless-stopped
-    user: "0:0"  # Run as root to access docker socket
-    command: forgejo-runner daemon
+    user: "0:0"  # Run as root to access Docker socket
+    command: forgejo-runner daemon --config /config.yaml
+    environment:
+      - CONFIG_FILE=/config.yaml
     volumes:
       - ./data:/data
       - ./config/config.yaml:/config.yaml
       - /var/run/docker.sock:/var/run/docker.sock
-    environment:
-      - CONFIG_FILE=/config.yaml
+    network_mode: host