diff --git a/linux/build/runner/docker-compose.yml b/linux/build/runner/docker-compose.yml
index 1dc6d29..85c61a9 100644
--- a/linux/build/runner/docker-compose.yml
+++ b/linux/build/runner/docker-compose.yml
@@ -31,10 +31,19 @@ services:
       # that keeps the silvermetal-builder image minimal and avoids nesting
       # docker-cli inside our own pinned image.
       GITEA_RUNNER_LABELS: "silvermetal-builder:docker://catthehacker/ubuntu:act-latest,ubuntu-latest:docker://catthehacker/ubuntu:act-latest"
+      # Tell run.sh to launch act_runner with `--config /etc/act_runner/config.yaml`.
+      # Without this env, run.sh skips --config entirely and act_runner falls
+      # back to compiled-in defaults — silently ignoring everything in
+      # config.yaml (timeout, container.options, valid_volumes…).
+      CONFIG_FILE: /etc/act_runner/config.yaml
     volumes:
       - runner-data:/data
       - /var/run/docker.sock:/var/run/docker.sock
       - /root/.docker:/root/.docker:ro
+      # Bind the runner config in. With CONFIG_FILE set above, run.sh hands
+      # this path to `act_runner daemon --config`. Both the host file and the
+      # mount path must match the env var exactly.
+      - ./config.yaml:/etc/act_runner/config.yaml:ro
       # Cache for snapshot.debian.org and apt downloads — survives container
       # recreate, avoids repeated mirror traffic and the rate-limit risk.
       - /opt/silvermetal-builder-runner/cache:/cache