diff --git a/hosts/forgejo-runner/default.nix b/hosts/forgejo-runner/default.nix
index 774d39a..e1b9140 100644
--- a/hosts/forgejo-runner/default.nix
+++ b/hosts/forgejo-runner/default.nix
@@ -5,6 +5,7 @@
     ../common.nix
     ../../services/openssh.nix
     ../../services/prometheus-node.nix
+    ./podman.nix
     ./forgejo-runner.nix
   ];
 
diff --git a/hosts/forgejo-runner/forgejo-runner.nix b/hosts/forgejo-runner/forgejo-runner.nix
index bc17c77..00689a7 100644
--- a/hosts/forgejo-runner/forgejo-runner.nix
+++ b/hosts/forgejo-runner/forgejo-runner.nix
@@ -49,4 +49,38 @@
       };
     };
   };
+
+  systemd = {
+    services."forgejo-runner-container-updater" = {
+      description = "Update forgejo runner container images";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      serviceConfig.Type = "oneshot";
+      script = ''
+        set -uo pipefail
+        failed=0
+        images=(
+          docker.io/library/debian:stable-slim
+          docker.io/library/alpine:latest
+          docker.io/moby/buildkit:latest
+        )
+        for image in "''${images[@]}"; do
+          echo "Pulling $image..."
+          if ! ${pkgs.podman}/bin/podman pull "$image"; then
+            echo "Failed to pull $image"
+            failed=1
+          fi
+        done
+        exit $failed
+      '';
+    };
+    timers."forgejo-runner-container-updater" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "daily";
+        RandomizedDelaySec = "30m";
+        Persistent = true;
+      };
+    };
+  };
 }
diff --git a/hosts/forgejo-runner/podman.nix b/hosts/forgejo-runner/podman.nix
new file mode 100644
index 0000000..462cadc
--- /dev/null
+++ b/hosts/forgejo-runner/podman.nix
@@ -0,0 +1,26 @@
+{ ... }:
+
+{
+  virtualisation.podman = {
+    enable = true;
+    dockerSocket.enable = true;
+    autoPrune = {
+      enable = true;
+      dates = "weekly";
+    };
+    defaultNetwork.settings = {
+      dns_enabled = true;
+      ipv6_enabled = true;
+      subnets = [
+        {
+          gateway = "10.88.0.1";
+          subnet = "10.88.0.0/16";
+        }
+        {
+          gateway = "fd10:88::1";
+          subnet = "fd10:88::/64";
+        }
+      ];
+    };
+  };
+}