diff --git a/argocd/manifests/forgejo-runner/configmap.yaml b/argocd/manifests/forgejo-runner/configmap.yaml
index 9ca43bf..91d2405 100644
--- a/argocd/manifests/forgejo-runner/configmap.yaml
+++ b/argocd/manifests/forgejo-runner/configmap.yaml
@@ -18,7 +18,7 @@ data:
         TZ: America/Los_Angeles
 
     container:
-      # Use our custom job execution image with Node.js + Docker CLI
+      # Job execution image is set via RUNNER_LABELS in external-secret.yaml
       network: "host"
       # Connect to DinD sidecar via TCP (not socket)
       docker_host: tcp://127.0.0.1:2375
diff --git a/argocd/manifests/forgejo-runner/external-secret.yaml b/argocd/manifests/forgejo-runner/external-secret.yaml
index 6041b7a..32a9176 100644
--- a/argocd/manifests/forgejo-runner/external-secret.yaml
+++ b/argocd/manifests/forgejo-runner/external-secret.yaml
@@ -25,7 +25,7 @@ spec:
       data:
         FORGEJO_URL: "https://forge.ops.eblu.me"
         RUNNER_NAME: "k8s-runner"
-        RUNNER_LABELS: "k8s:docker://registry.ops.eblu.me/blumeops/forgejo-runner:v2.6.0"
+        RUNNER_LABELS: "k8s:docker://registry.ops.eblu.me/blumeops/forgejo-runner:v3.0.0"
         RUNNER_TOKEN: "{{ .runner_token }}"
   data:
   - secretKey: runner_token