diff --git a/docker-compose-infra-main.yml b/docker-compose-infra-main.yml
index f4af6f4..0617b42 100644
--- a/docker-compose-infra-main.yml
+++ b/docker-compose-infra-main.yml
@@ -187,6 +187,33 @@ services:
       timeout: 5s
       retries: 3
 
+  # ---- Gitea CI/CD Runner (act_runner) ----
+  # host 模式：job 在 runner 容器内直接执行（kubectl/docker 可直接用）
+  # k3s 在 121.37.117.181，经宿主机 systemd 服务 k3s-ssh-tunnel.service
+  # (ssh -L 16443:127.0.0.1:6443) 隧道访问，故 runner 必须与隧道同网络命名空间
+  gitea-runner:
+    image: gitea/act_runner:latest
+    container_name: gitea-runner
+    restart: unless-stopped
+    network_mode: host
+    depends_on:
+      gitea:
+        condition: service_healthy
+    environment:
+      GITEA_INSTANCE_URL: http://127.0.0.1:3000
+      GITEA_RUNNER_REGISTRATION_TOKEN: 9lGvGJxk7M781IYBWDV0ZuZpXV5RkGKlIpkhRVNs
+      TAGS: "ubuntu-latest:host"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /data/gitea-runner:/data
+      - /data/gitea-runner/bin/kubectl:/usr/local/bin/kubectl
+      - /data/gitea-runner/.kube/config:/root/.kube/config
+    healthcheck:
+      test: ["CMD-SHELL", "test -f /data/.runner"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+
   # ---- Nginx 反向代理 ----
   nginx:
     build: