diff --git a/argocd/manifests/forgejo-runner/deployment.yaml b/argocd/manifests/forgejo-runner/deployment.yaml
index 0361f9b..b4d5b88 100644
--- a/argocd/manifests/forgejo-runner/deployment.yaml
+++ b/argocd/manifests/forgejo-runner/deployment.yaml
@@ -29,7 +29,7 @@ spec:
             - name: RUNNER_NAME
               value: "k8s-runner"
             - name: RUNNER_LABELS
-              value: "k8s:docker://registry.ops.eblu.me/blumeops/forgejo-runner:v0.19.11-96a2d42"
+              value: "k8s:docker://registry.ops.eblu.me/blumeops/runner-job-image:v0.19.11-4c5e0f0"
           command:
             - /bin/sh
             - -c
diff --git a/argocd/manifests/grafana/deployment.yaml b/argocd/manifests/grafana/deployment.yaml
index dcfd858..00a5970 100644
--- a/argocd/manifests/grafana/deployment.yaml
+++ b/argocd/manifests/grafana/deployment.yaml
@@ -88,7 +88,7 @@ spec:
               mountPath: /tmp/dashboards
         # Grafana
         - name: grafana
-          image: registry.ops.eblu.me/blumeops/grafana:v12.3.3-13390f6
+          image: registry.ops.eblu.me/blumeops/grafana:v12.3.3-b1ea762
           imagePullPolicy: IfNotPresent
           env:
             - name: POD_IP
diff --git a/containers/grafana/Dockerfile b/containers/grafana/Dockerfile
index c3010c7..c3107c4 100644
--- a/containers/grafana/Dockerfile
+++ b/containers/grafana/Dockerfile
@@ -33,7 +33,7 @@ RUN set -e && \
     url="https://dl.grafana.com/oss/release/grafana-${GRAFANA_VERSION}.linux-${ARCH}.tar.gz" && \
     echo "URL: $url" && \
     curl -fSL "$url" | tar -xz -C /tmp && \
-    mv /tmp/grafana-v${GRAFANA_VERSION} /usr/share/grafana && \
+    mv /tmp/grafana-${GRAFANA_VERSION} /usr/share/grafana && \
     apk del curl
 
 # Standard Grafana paths
diff --git a/containers/forgejo-runner/Dockerfile b/containers/runner-job-image/Dockerfile
similarity index 97%
rename from containers/forgejo-runner/Dockerfile
rename to containers/runner-job-image/Dockerfile
index e8b385d..8c233cc 100644
--- a/containers/forgejo-runner/Dockerfile
+++ b/containers/runner-job-image/Dockerfile
@@ -7,7 +7,7 @@
 # so this image only needs: git, Docker CLI, Dagger CLI, ArgoCD CLI, uv, yq, and basic tools.
 #
 # Usage: Configure runner with label like:
-#   docker:docker://registry.ops.eblu.me/blumeops/forgejo-runner:latest
+#   docker:docker://registry.ops.eblu.me/blumeops/runner-job-image:latest
 
 ARG CONTAINER_APP_VERSION=0.19.11
 
diff --git a/docs/changelog.d/+rename-runner-job-image.infra.md b/docs/changelog.d/+rename-runner-job-image.infra.md
new file mode 100644
index 0000000..1d6b7bb
--- /dev/null
+++ b/docs/changelog.d/+rename-runner-job-image.infra.md
@@ -0,0 +1 @@
+Rename `containers/forgejo-runner` to `containers/runner-job-image` to distinguish the CI job execution image from the Forgejo runner daemon, fixing a version-check false positive.
diff --git a/docs/how-to/configuration/update-documentation.md b/docs/how-to/configuration/update-documentation.md
index 5a5c6bc..fef8ccf 100644
--- a/docs/how-to/configuration/update-documentation.md
+++ b/docs/how-to/configuration/update-documentation.md
@@ -67,7 +67,7 @@ Fragments are automatically collected into `CHANGELOG.md` (at repo root) during
 The workflow runs on the `k8s` label, which uses the [[forgejo]]-runner in Kubernetes:
 
 - **Runner deployment**: `argocd/manifests/forgejo-runner/`
-- **Job image**: `registry.ops.eblu.me/blumeops/forgejo-runner:latest`
+- **Job image**: `registry.ops.eblu.me/blumeops/runner-job-image` (commit-SHA tagged)
 - **Build engine**: [[dagger]] CLI installed at runtime; Node.js and Python run inside Dagger containers
 
 The job image is built from `containers/forgejo-runner/Dockerfile`.
diff --git a/docs/how-to/grafana/build-grafana-container.md b/docs/how-to/grafana/build-grafana-container.md
index 054a4d9..ce6c557 100644
--- a/docs/how-to/grafana/build-grafana-container.md
+++ b/docs/how-to/grafana/build-grafana-container.md
@@ -22,6 +22,10 @@ Grafana currently uses the upstream `docker.io/grafana/grafana:11.4.0` image via
 3. Tag and push to `forge.ops.eblu.me/eblume/grafana:<version>`
 4. Add to `mise run container-list` inventory
 
+## Lessons
+
+- **Tarball directory name:** The Grafana OSS tarball extracts to `grafana-<version>` (e.g. `grafana-12.3.3`), *not* `grafana-v<version>`. The `mv` command in the Dockerfile must match this.
+
 ## Reference
 
 - Follow [[build-container-image]] for the standard container build workflow
diff --git a/service-versions.yaml b/service-versions.yaml
index 4f96986..92e4d65 100644
--- a/service-versions.yaml
+++ b/service-versions.yaml
@@ -190,8 +190,17 @@ services:
     current-version: "12.7.0"
     upstream-source: https://code.forgejo.org/forgejo/runner/releases
     notes: >-
-      Runner daemon version. Job execution container (containers/forgejo-runner)
-      tracks Dagger at v0.19.11.
+      Runner daemon version (code.forgejo.org/forgejo/runner). Job execution
+      image is tracked separately as runner-job-image.
+
+  - name: runner-job-image
+    type: argocd
+    last-reviewed: 2026-02-23
+    current-version: "0.19.11"
+    upstream-source: https://github.com/dagger/dagger/releases
+    notes: >-
+      Forgejo Actions job execution image. CONTAINER_APP_VERSION tracks the
+      Dagger CLI version, the primary build tool in the image.
 
   - name: nix-container-builder
     type: nixos