diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index c046de9..610d258 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -13,12 +13,16 @@ concurrency:
 jobs:
   build:
     runs-on: docker-ready
+    # Explicit container: (rather than relying only on the docker-ready
+    # label mapping) so job-level container options are reliably honored.
+    container:
+      image: ci.nxtgauge.com/admin/forgejo-runner-job:bookworm
+      options: --add-host=host.docker.internal:host-gateway
     env:
       # 127.0.0.1 doesn't work here: the job container is nested one level
       # inside the runner pod's dind sidecar, so its own loopback isn't the
-      # sidecar's. host.docker.internal (mapped via --add-host in the
-      # runner's container.options) reaches back to the dind engine that
-      # actually spawned this container.
+      # sidecar's. host.docker.internal (mapped via --add-host above)
+      # reaches back to the dind engine that actually spawned this container.
       DOCKER_HOST: tcp://host.docker.internal:2375
       DOCKER_BUILDKIT: "1"
     steps: