diff --git a/.forgejo/workflows/default.yml b/.forgejo/workflows/default.yml
index a9e7ce2..bc5b9aa 100644
--- a/.forgejo/workflows/default.yml
+++ b/.forgejo/workflows/default.yml
@@ -7,13 +7,15 @@ env:
 
 jobs:
   build:
-    runs-on: native
+    runs-on: debian-latest
     steps:
       - uses: https://code.forgejo.org/actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/magic-nix-cache-action@main
       - run: nix build .#nixosConfigurations.bragi.config.system.build.toplevel
       - run: nix build .#nixosConfigurations.thor.config.system.build.toplevel
       - run: nix build .#nixosConfigurations.odin.config.system.build.toplevel
       - run: nix build .#nixosConfigurations.freyja.config.system.build.toplevel
       - run: |
-          attic login actions https://cache.cronyakatsuki.xyz ${{ secrets.ATTIC_TOKEN }}
-          attic push system result -j 2
+          nix run github:zhaofengli/attic#default login actions https://cache.cronyakatsuki.xyz ${{ secrets.ATTIC_TOKEN }}
+          nix run github:zhaofengli/attic#default push system result -j 2
diff --git a/modules/servers/per-server/freyja/services/forgejo-runner.nix b/modules/servers/per-server/freyja/services/forgejo-runner.nix
index 6bd5428..fe98352 100644
--- a/modules/servers/per-server/freyja/services/forgejo-runner.nix
+++ b/modules/servers/per-server/freyja/services/forgejo-runner.nix
@@ -13,9 +13,8 @@
       # tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd
       tokenFile = config.age.secrets.forgejo-runner-token.path;
       labels = [
-        "node:docker://node:22-bookworm"
-        "nix:docker://forgejo-runner-nix"
         ## optionally provide native execution on the host:
+        "debian-latest:docker://node:18-bullseye"
         "native:host"
       ];
       hostPackages = with pkgs; [