diff --git a/.gitea/workflows/demo.yaml b/.gitea/workflows/demo.yaml
new file mode 100644
index 0000000..496acab
--- /dev/null
+++ b/.gitea/workflows/demo.yaml
@@ -0,0 +1,42 @@
+# Demo workflow showing Gitea Actions running on the in-cluster runner.
+name: Demo
+on:
+  push:
+  workflow_dispatch:
+
+jobs:
+  hello:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Say hello
+        run: |
+          echo "Hello from Gitea Actions on ${{ gitea.server_url }}"
+          echo "Repository: ${{ gitea.repository }}"
+          echo "Ref:        ${{ gitea.ref }}"
+          echo "Commit:     ${{ gitea.sha }}"
+          echo "Triggered by: ${{ gitea.actor }} (${{ gitea.event_name }})"
+
+      - name: Check out the role
+        uses: actions/checkout@v4
+
+      - name: Show the role layout
+        run: find . -path ./.git -prune -o -type f -print | sort
+
+      - name: Validate YAML
+        run: |
+          python3 -c 'import yaml' 2>/dev/null || (apt-get update -qq && apt-get install -y -qq python3-yaml >/dev/null)
+          python3 - <<'PY'
+          import pathlib, sys
+          import yaml
+          bad = 0
+          for p in sorted(pathlib.Path('.').rglob('*.y*ml')):
+              if '.git' in p.parts:
+                  continue
+              try:
+                  yaml.safe_load(p.read_text())
+                  print(f"ok   {p}")
+              except yaml.YAMLError as e:
+                  bad += 1
+                  print(f"FAIL {p}: {e}")
+          sys.exit(1 if bad else 0)
+          PY
diff --git a/defaults/main.yml b/defaults/main.yml
index ba247cc..86f6cba 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -1,3 +1,13 @@
 #SPDX-License-Identifier: MIT-0
 ---
 # defaults file for ansible-role-gitea
+
+# CIDRs allowed to set X-Forwarded-For / X-Real-IP for Gitea.
+# 10.244.0.0/16 is the cluster pod network, where ingress-nginx runs.
+gitea_trusted_proxies: "127.0.0.0/8,::1/128,10.244.0.0/16"
+
+# Gitea Actions runner (gitea/actions chart)
+gitea_actions_enabled: true
+gitea_actions_chart_version: 0.1.2
+gitea_actions_runner_replicas: 1
+gitea_actions_runner_token_secret: gitea-actions-runner-token
diff --git a/tasks/actions.yaml b/tasks/actions.yaml
index ff7b2b2..38dcf43 100644
--- a/tasks/actions.yaml
+++ b/tasks/actions.yaml
@@ -1,23 +1,77 @@
-- name: deploy actions
+---
+# Deploys an instance-wide Gitea Actions runner (act_runner + DinD).
+- name: check for existing runner registration token secret
+  kubernetes.core.k8s_info:
+    kind: Secret
+    namespace: gitea
+    name: "{{ gitea_actions_runner_token_secret }}"
+  register: runner_token_secret
+
+- name: generate and store a runner registration token
+  when: runner_token_secret.resources | length == 0
+  block:
+    - name: find a running gitea pod
+      kubernetes.core.k8s_info:
+        kind: Pod
+        namespace: gitea
+        label_selectors:
+          - app.kubernetes.io/name=gitea
+          - app.kubernetes.io/instance=gitea
+        field_selectors:
+          - status.phase=Running
+      register: gitea_pods
+
+    - name: generate instance-level runner registration token
+      kubernetes.core.k8s_exec:
+        namespace: gitea
+        pod: "{{ gitea_pods.resources[0].metadata.name }}"
+        container: gitea
+        command: gitea actions generate-runner-token
+      register: runner_token
+      no_log: true
+
+    - name: store runner registration token
+      kubernetes.core.k8s:
+        state: present
+        definition:
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: "{{ gitea_actions_runner_token_secret }}"
+            namespace: gitea
+          type: Opaque
+          stringData:
+            token: "{{ runner_token.stdout | trim }}"
+      no_log: true
+
+- name: deploy gitea actions runner
   kubernetes.core.helm:
-    name: gitea
+    name: gitea-actions
     chart_ref: gitea/actions
+    chart_version: "{{ gitea_actions_chart_version }}"
     release_namespace: gitea
     create_namespace: true
     values:
       enabled: true
-      provisioning:
-        enabled: true
+      giteaRootURL: https://gitea.eom.dev
+      existingSecret: "{{ gitea_actions_runner_token_secret }}"
+      existingSecretKey: token
       statefulset:
-        actRunner:
+        replicas: "{{ gitea_actions_runner_replicas }}"
+        persistence:
+          size: 1Gi
+        runner:
           config: |
-            log:                                                                                                                            
-              level: debug                                                                                                                  
-            cache:                                                                                                                          
-              enabled: false                                                                                                                
+            log:
+              level: info
+            cache:
+              enabled: false
+            container:
+              require_docker: true
+              docker_timeout: 300s
             runner:
+              capacity: 2
               labels:
-                - "ubuntu-latest:docker://node:16-bullseye"
-                - "ubuntu-22.04:docker://node:16-bullseye"
-                - "ubuntu-20.04:docker://node:16-bullseye"
-                - "ubuntu-18.04:docker://node:16-buster"
+                - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+                - "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
+                - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
diff --git a/tasks/gitea.yaml b/tasks/gitea.yaml
index c650d60..31cb8ba 100644
--- a/tasks/gitea.yaml
+++ b/tasks/gitea.yaml
@@ -72,6 +72,13 @@
             EMAIL_DOMAIN_BLOCKLIST: "spammer.com,mailinator.com,tempmail.com,10minutemail.com,guerrillamail.com,dispostable.com,fakemail.com,maildrop.cc,trashmail.com,yopmail.com,techstrategylab.com,timminsgoldminetour.com,claxyn.org,sise.claxyn.org,blyxen.com,seti.blyxen.com,tute.blyxen.com,tula.blyxen.com,sise.blyxen.org,ivolix.com,seti.lyvix.org,tute.lyvix.org,seti.ivolix.org,semo.ivolix.com,elyquin.org,simu.elyquin.org,semo.claxyn.com,sise.oxilv.com,simu.glinxy.org,simu.hivoltz.org,semo.elyquin.com,prisite.online,sise.dravix.org,dravix.org,semo.glinxy.com,glinxy.com,dark-webmarket.com,seti.juxal.org,juxal.org,9e5d.getir.space,getir.space,topcompanygroup.com,6d43.getir.space,9e2d.mikrowellen-tests.com,verifiedlinklist.com,xylzen.com,tapi.xylzen.com,ylixo.com,tapi.ylixo.com,tute.ylixo.com,estrella.glinxy.com,nestmailbox.com,theweifamily.icu,1mail.x24hr.com,8.dnsabr.com,23.8.dnsabr.com,2712.bubbles-swimming.co.uk,anonmails.de,spambog.ru,anonmails.de,virginvoyages.click,travellersrest.click,mailus.virginvoyages.com,tula.hivoltz.org,theblueholiday.click,mailius.virginvoyages.com,travellersrest.click,twitch.work,backlinks.monster,onlinecmail.com,gsasearchenginerankervps.com,seoautomationpro.online"
             ENABLE_CAPTCHA: true
             REGISTER_EMAIL_CONFIRM: true
+          security:
+            # Trust X-Forwarded-For from ingress-nginx (pod network) so Gitea
+            # logs the real client address instead of the ingress pod IP.
+            REVERSE_PROXY_LIMIT: 1
+            REVERSE_PROXY_TRUSTED_PROXIES: "{{ gitea_trusted_proxies }}"
+          actions:
+            ENABLED: true
           oauth2_client:
             ENABLE_AUTO_REGISTRATION: true
             UPDATE_AVATAR: true
diff --git a/tasks/main.yml b/tasks/main.yml
index 7f085fd..ea9b4cc 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -2,6 +2,8 @@
 ---
 # tasks file for ansible-role-gitea
 - name: gitea
-  include_tasks: "{{ item }}"
-  loop:
-    - gitea.yaml
+  include_tasks: gitea.yaml
+
+- name: gitea actions runner
+  include_tasks: actions.yaml
+  when: gitea_actions_enabled | bool