diff --git a/hosts/netty/forgejo-runner.nix b/hosts/netty/forgejo-runner.nix
index 276f6e6..f4cedeb 100644
--- a/hosts/netty/forgejo-runner.nix
+++ b/hosts/netty/forgejo-runner.nix
@@ -9,9 +9,21 @@ let
 in
 {
   systemd.services.gitea-runner-netty.serviceConfig = {
+    DynamicUser = lib.mkForce false;
+    User = lib.mkForce "gitea-runner";
+    Group = lib.mkForce "gitea-runner";
     NoNewPrivileges = lib.mkForce false;
+    RestrictSUIDSGID = lib.mkForce false;
   };
 
+  users.users.gitea-runner = {
+    isSystemUser = true;
+    group = "gitea-runner";
+    home = "/var/lib/gitea-runner";
+    createHome = true;
+  };
+  users.groups.gitea-runner = { };
+
   security.sudo.extraRules = [
     {
       users = [ "gitea-runner" ];