diff --git a/clusters/homelab/apps/forgejo-runner.yaml b/clusters/homelab/apps/forgejo-runner.yaml
new file mode 100644
index 0000000..917ccf4
--- /dev/null
+++ b/clusters/homelab/apps/forgejo-runner.yaml
@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: forgejo-runner
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./clusters/homelab/apps/forgejo-runner
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
diff --git a/clusters/homelab/apps/forgejo-runner/configmap.yaml b/clusters/homelab/apps/forgejo-runner/configmap.yaml
new file mode 100644
index 0000000..8e650bf
--- /dev/null
+++ b/clusters/homelab/apps/forgejo-runner/configmap.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: forgejo-runner-config
+  namespace: forgejo-runner
+data:
+  config.yaml: |
+    log:
+      level: info
+    runner:
+      file: .runner
+      capacity: 2
+      timeout: 3h
+      insecure: false
+    cache:
+      enabled: true
+      dir: /cache
+    container:
+      network: bridge
+      privileged: true
+      valid_volumes:
+        - /cache
diff --git a/clusters/homelab/apps/forgejo-runner/deployment.yaml b/clusters/homelab/apps/forgejo-runner/deployment.yaml
new file mode 100644
index 0000000..792990c
--- /dev/null
+++ b/clusters/homelab/apps/forgejo-runner/deployment.yaml
@@ -0,0 +1,102 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: forgejo-runner
+  namespace: forgejo-runner
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: forgejo-runner
+  template:
+    metadata:
+      labels:
+        app: forgejo-runner
+    spec:
+      serviceAccountName: forgejo-runner
+      initContainers:
+        - name: runner-register
+          image: code.forgejo.org/forgejo/runner:6.3.1
+          command:
+            - forgejo-runner
+            - register
+            - --no-interactive
+            - --config
+            - /config/config.yaml
+            - --token
+            - $(REGISTRATION_TOKEN)
+            - --name
+            - $(RUNNER_NAME)
+            - --instance
+            - $(FORGEJO_INSTANCE_URL)
+            - --labels
+            - "docker:docker://node:20-bullseye"
+          env:
+            - name: REGISTRATION_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: forgejo-runner-secret
+                  key: REGISTRATION_TOKEN
+            - name: RUNNER_NAME
+              valueFrom:
+                secretKeyRef:
+                  name: forgejo-runner-secret
+                  key: RUNNER_NAME
+            - name: FORGEJO_INSTANCE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: forgejo-runner-secret
+                  key: FORGEJO_INSTANCE_URL
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: runner-data
+              mountPath: /data
+      containers:
+        - name: runner
+          image: code.forgejo.org/forgejo/runner:6.3.1
+          command:
+            - forgejo-runner
+            - daemon
+            - --config
+            - /config/config.yaml
+          env:
+            - name: DOCKER_HOST
+              value: tcp://localhost:2376
+            - name: DOCKER_TLS_CERTDIR
+              value: /certs
+            - name: DOCKER_TLS_VERIFY
+              value: "1"
+            - name: DOCKER_CERT_PATH
+              value: /certs/client
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: runner-data
+              mountPath: /data
+            - name: docker-certs
+              mountPath: /certs
+            - name: cache
+              mountPath: /cache
+        - name: dind
+          image: docker:27-dind
+          securityContext:
+            privileged: true
+          env:
+            - name: DOCKER_TLS_CERTDIR
+              value: /certs
+          volumeMounts:
+            - name: docker-certs
+              mountPath: /certs
+            - name: cache
+              mountPath: /cache
+      volumes:
+        - name: config
+          configMap:
+            name: forgejo-runner-config
+        - name: runner-data
+          emptyDir: {}
+        - name: docker-certs
+          emptyDir: {}
+        - name: cache
+          emptyDir: {}
diff --git a/clusters/homelab/apps/forgejo-runner/kustomization.yaml b/clusters/homelab/apps/forgejo-runner/kustomization.yaml
new file mode 100644
index 0000000..9a9d8e8
--- /dev/null
+++ b/clusters/homelab/apps/forgejo-runner/kustomization.yaml
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - serviceaccount.yaml
+  - configmap.yaml
+  - secret.sops.yaml
+  - deployment.yaml
diff --git a/clusters/homelab/apps/forgejo-runner/namespace.yaml b/clusters/homelab/apps/forgejo-runner/namespace.yaml
new file mode 100644
index 0000000..19441b1
--- /dev/null
+++ b/clusters/homelab/apps/forgejo-runner/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: forgejo-runner
diff --git a/clusters/homelab/apps/forgejo-runner/secret.sops.yaml b/clusters/homelab/apps/forgejo-runner/secret.sops.yaml
new file mode 100644
index 0000000..da15c82
--- /dev/null
+++ b/clusters/homelab/apps/forgejo-runner/secret.sops.yaml
@@ -0,0 +1,29 @@
+apiVersion: ENC[AES256_GCM,data:A+0=,iv:RiEw7RstCEPY6+XFihiJmA4HTcVNko9Gq9yw9Mv5fRA=,tag:yUM+O985LjDXBEtiiwBYeg==,type:str]
+kind: ENC[AES256_GCM,data:yWK8r5Va,iv:jMyXDDdBr4zOuwPKYDLo22sM171YpoAZV14q9ubM2Lc=,tag:26ppJLvpj3LOai0AqUwILA==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:HRAjTrHiBk9lgToNBLd4e8yD0uMs,iv:rMo53bqSAW3xywOQgr8EZHT5g+sM6EFvR7Srg4yumbQ=,tag:slABQislS8foKh2sSWIa6A==,type:str]
+    namespace: ENC[AES256_GCM,data:93wKmRdaS3ArRbjmhnY=,iv:ab1sp7LDnAdmrnbzz1tEmqPdXGCSi/b8EiDe0qO9nt0=,tag:3VEkdZDdMl/9jMyYSTeICg==,type:str]
+stringData:
+    FORGEJO_INSTANCE_URL: ENC[AES256_GCM,data:Gvv31rhe7QHdMUe1fAKasUbV/vLdcajD+kw/uYs=,iv:7tVEAGMfPqlIyp4UohE17EIlnz0ckybpWAg3Kh+m6Aw=,tag:zdij/4Ny3X/8dudJsVZlcg==,type:str]
+    REGISTRATION_TOKEN: ENC[AES256_GCM,data:fjxVxZh1jb0q6fCKNrbFmQpT24+3OOLX32R93sdMS1JFsaOvCWGf3A==,iv:dicO4GAG9KLvyTBH/NEq4D4/N/RXyNH1h7KY9Czaqe0=,tag:4SG7eE3BhQo2yghMpK2nbg==,type:str]
+    RUNNER_NAME: ENC[AES256_GCM,data:KkR5Vxddh2bdM9473E4=,iv:gleeckI21EjjJ+LFpyE1U92nQoUV+goYkymp/s8UU+8=,tag:jBZYoy1aABm3bqIvSHl1jQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxWEI5TGVHSzNkczNTeE1B
+            OVhubEhxQVJDVWozMzZXc29sVkU1TVVHWTNNCllPcW5lZmZIQlZhUDFqdHZRRWtI
+            RmhzeWdlcXJpZEMvRXRlMDhONk1PQ1kKLS0tIGlhdC9DbmFlUmxvYkdNRDU2NFM0
+            NHdYQ2lXYk1HYzdsZlI3WFAzUmh6VUUK93zFuFaWfBRFkzUDA+B+Yn+N8BgA9Uov
+            V5lbOX0cpxxHWyWXH6KxmHr2Fy2MWKTDensa5kC8nH8c/h0uWdGmmg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-06T21:12:09Z"
+    mac: ENC[AES256_GCM,data:ck2cL5TNRK6w8BLr4SIHXJjrC6WbRjFJVpPSdShRTJxFs3HtWb+NEmSryjo5zAingETD59WeUWL62m00zT0epArdg6tCDjZDhS29hhZizC4g74TMfxkdBJ0LyQGh16G2fjT82c0QRxm5VVV8S1vG94VLD0zw8ldYMF7nj/FYKSg=,iv:J03M2cVog0u+SUi/S9LKWLhUhnE0fOVdaI/cXxAi5j0=,tag:3YfP8yA9aHt5AbI94BUAxQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4
diff --git a/clusters/homelab/apps/forgejo-runner/serviceaccount.yaml b/clusters/homelab/apps/forgejo-runner/serviceaccount.yaml
new file mode 100644
index 0000000..ef8cb25
--- /dev/null
+++ b/clusters/homelab/apps/forgejo-runner/serviceaccount.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: forgejo-runner
+  namespace: forgejo-runner