diff --git a/global/overlay/etc/puppet/modules/soc/manifests/runner.pp b/global/overlay/etc/puppet/modules/soc/manifests/runner.pp
index 9d5b53e..c788143 100644
--- a/global/overlay/etc/puppet/modules/soc/manifests/runner.pp
+++ b/global/overlay/etc/puppet/modules/soc/manifests/runner.pp
@@ -5,7 +5,7 @@ class soc::runner(
 {
   $runner_token = lookup({ 'name' => 'runner_token.vuln_management_repo', 'default_value' => undef })
   $runner_labels = join([
-	  "pkthon:docker://nikolaik/python3.12-nodejs23",
+	  "python:docker://nikolaik/python3.12-nodejs23",
 	  "ubuntu-22.04:docker://catthehacker/ubuntu:act-22.04",
   ], ',')
 
diff --git a/global/overlay/etc/puppet/modules/soc/templates/runner/docker-compose.yml.erb b/global/overlay/etc/puppet/modules/soc/templates/runner/docker-compose.yml.erb
index 5bd72b4..afbf062 100644
--- a/global/overlay/etc/puppet/modules/soc/templates/runner/docker-compose.yml.erb
+++ b/global/overlay/etc/puppet/modules/soc/templates/runner/docker-compose.yml.erb
@@ -52,8 +52,6 @@ services:
     volumes:
       - /opt/forgejo-runner/data:/data
       - /opt/forgejo-runner/docker_certs:/certs
-    command:
-      - 'forgejo-runner'
-      - '--config'
-      - 'config.yml'
-      - 'daemon'
+    command: >-
+      sed -i '\|options:| a --mount type=bind,source=/certs/client,target=/certs/client,readonly'
+      forgejo-runner --config config.yml daemon