diff --git a/yami-dev-stack.nix b/yami-dev-stack.nix
index 19e1041..5986d48 100644
--- a/yami-dev-stack.nix
+++ b/yami-dev-stack.nix
@@ -142,9 +142,10 @@ in
       requires = [ "gitea.service" "docker.service" ];
     };
 
-    # Directory for the runner token file; owner matches the runner service user.
+    # Runner uses DynamicUser, so there's no static gitea-runner user/group.
+    # The token file is read by the root-run pre-start, so root owns it.
     systemd.tmpfiles.rules = [
-      "d /var/lib/gitea-runner 0700 gitea-runner gitea-runner -"
+      "d /var/lib/gitea-runner 0700 root root -"
     ];
 
     # ── Shell aliases ──────────────────────────────────────────────────────────