diff --git a/darwin/shiro/configuration.nix b/darwin/shiro/configuration.nix
index 650f392..d923d43 100644
--- a/darwin/shiro/configuration.nix
+++ b/darwin/shiro/configuration.nix
@@ -45,7 +45,7 @@
   users.users.remotebuilder = {
     description = "User for Nix remote builds";
     uid = 700;
-    # home = "/var/remotebuilder";
+    home = "/var/lib/remotebuilder";
     createHome = true;
     shell = "/bin/bash";
     openssh.authorizedKeys.keyFiles = [
@@ -53,6 +53,7 @@
       ../../secrets/id_ios.pub
     ];
   };
+  users.knownUsers = ["remotebuilder"];
 
   # security.pam.enableSudoTouchIdAuth = true;
   # system.patches = [
diff --git a/darwin/shiro/services/gitea-runner.nix b/darwin/shiro/services/gitea-runner.nix
index a48ea27..d42a6f8 100644
--- a/darwin/shiro/services/gitea-runner.nix
+++ b/darwin/shiro/services/gitea-runner.nix
@@ -5,8 +5,11 @@
   lib,
   ...
 }: let
+  runnerUser = "_gitea-runner";
+  runnerUid = 701;
+  runnerHome = "/var/lib/gitea-runner";
   name = "shiro";
-  stateDir = "/var/lib/gitea-runner/${name}";
+  stateDir = "${runnerHome}/${name}";
   url = "https://git.darksailor.dev";
   labels = [
     "macos-latest:host"
@@ -70,11 +73,27 @@
     '';
   };
 in {
+  users.users.${runnerUser} = {
+    description = "Gitea Actions Runner";
+    uid = runnerUid;
+    home = runnerHome;
+    createHome = true;
+    shell = "/bin/bash";
+  };
+  users.knownUsers = [runnerUser];
+
   sops = {
-    secrets."gitea/registration" = {};
-    templates."GITEA_RUNNER_TOKEN.env".content = ''
-      TOKEN=${config.sops.placeholder."gitea/registration"}
-    '';
+    secrets."gitea/registration" = {
+      owner = null;
+      uid = runnerUid;
+    };
+    templates."GITEA_RUNNER_TOKEN.env" = {
+      owner = null;
+      uid = runnerUid;
+      content = ''
+        TOKEN=${config.sops.placeholder."gitea/registration"}
+      '';
+    };
   };
 
   launchd.daemons.gitea-runner = {
@@ -83,9 +102,9 @@ in {
       Label = "dev.darksailor.gitea-runner";
       RunAtLoad = true;
       KeepAlive = true;
-      UserName = device.user;
-      StandardOutPath = "/var/log/gitea-runner.log";
-      StandardErrorPath = "/var/log/gitea-runner.error.log";
+      UserName = runnerUser;
+      StandardOutPath = "${runnerHome}/gitea-runner.log";
+      StandardErrorPath = "${runnerHome}/gitea-runner.error.log";
     };
   };
 }