diff --git a/docker-compose.yml b/docker-compose.yml
index 55952ee..a0604a4 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -129,9 +129,39 @@ services:
       auth-proxy:
         condition: service_started
 
+  # --- Forgejo Actions -------------------------------------------------------
+  # Jobs run in a private Docker engine (docker-in-docker), never the host's,
+  # so a workflow cannot see or touch the forgejo/postgres/caddy containers.
+  # The runner is registered for the silentmode organisation only.
+  docker-in-docker:
+    image: docker:27-dind
+    privileged: true
+    restart: unless-stopped
+    command: ["dockerd", "-H", "tcp://0.0.0.0:2375", "--tls=false"]
+    expose:
+      - "2375"
+    volumes:
+      - dind-data:/var/lib/docker
+
+  runner:
+    image: data.forgejo.org/forgejo/runner:6.3.1
+    user: "0:0"
+    restart: unless-stopped
+    depends_on:
+      - docker-in-docker
+    environment:
+      DOCKER_HOST: tcp://docker-in-docker:2375
+    working_dir: /data
+    volumes:
+      - runner-data:/data
+    # waits for registration (/data/.runner) and the config written by scripts/runner-setup.sh
+    command: ["/bin/sh", "-c", "while [ ! -f /data/.runner ]; do sleep 30; done; sleep 5; exec forgejo-runner daemon --config /data/config.yml"]
+
 volumes:
   postgres-data:
   forgejo-data:
   auth-proxy-keys:
   caddy-data:
   caddy-config:
+  dind-data:
+  runner-data:
diff --git a/scripts/runner-setup.sh b/scripts/runner-setup.sh
new file mode 100644
index 0000000..994247d
--- /dev/null
+++ b/scripts/runner-setup.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Registers the Forgejo Actions runner (see the runner + docker-in-docker
+# services in docker-compose.yml) for the silentmode organisation. Run once
+# on the Hephaestus host from ~/hephaestus. Re-running replaces the
+# registration with a new one; delete the old runner in the org settings.
+#
+# Labels: jobs that say `runs-on: linux-x64` (or ubuntu-latest) run in a
+# node:22-bookworm container inside docker-in-docker, one at a time.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+NAME=${1:-hephaestus-linux}
+LABELS="linux-x64:docker://node:22-bookworm,ubuntu-latest:docker://node:22-bookworm"
+
+docker compose up -d docker-in-docker runner
+TOKEN=$(docker compose exec -T -u git forgejo forgejo actions generate-runner-token --scope silentmode | tail -n 1 | tr -d '\r')
+[ -n "$TOKEN" ] || { echo "no registration token" >&2; exit 1; }
+docker compose exec -T runner sh -c "
+  set -e
+  cd /data
+  rm -f .runner
+  forgejo-runner register --no-interactive --instance https://code.silentmode.st --token '$TOKEN' --name '$NAME' --labels '$LABELS'
+  forgejo-runner generate-config > config.yml
+  sed -i 's/^  capacity: .*/  capacity: 1/' config.yml
+"
+docker compose restart runner
+sleep 8
+docker compose logs --tail 20 runner