diff --git a/evolution/proposals/ECP-0123-instant-station-guide-and-player-warmup.md b/evolution/proposals/ECP-0123-instant-station-guide-and-player-warmup.md
index ee3e279..22a133d 100644
--- a/evolution/proposals/ECP-0123-instant-station-guide-and-player-warmup.md
+++ b/evolution/proposals/ECP-0123-instant-station-guide-and-player-warmup.md
@@ -48,6 +48,7 @@ Ship the static web change with the existing Worker asset deploy and roll the pu
 binary to the LA nodes so their catalogs match the current watcher schema. Validate with clean-cache
 desktop/mobile browser loads and check the app's `window.__ecPerf` marks plus a live tune through the
 public relay. The Forgejo workflows use the locally registered `namespace-profile-linux-medium`
-runner label so the Cloudflare deploy can actually leave the queue on the self-hosted forge.
-Teardown is removing the HTML seed/cache/warmup path, returning to live-API-only station rendering,
-and explicitly passing `--passthrough=false` only if an older watcher path is restored.
+runner label and ecp-forge runs a persistent `forgejo-runner-agent` service with a normal shell
+tool PATH so the Cloudflare deploy can actually leave the queue on the self-hosted forge. Teardown is
+removing the HTML seed/cache/warmup path, returning to live-API-only station rendering, and
+explicitly passing `--passthrough=false` only if an older watcher path is restored.
diff --git a/nix/nixos/ecp-forge.nix b/nix/nixos/ecp-forge.nix
index 6b515a2..bf7d684 100644
--- a/nix/nixos/ecp-forge.nix
+++ b/nix/nixos/ecp-forge.nix
@@ -72,6 +72,16 @@ in
       ];
     };
     groups.conradev = { };
+    groups.forgejo-runner = {
+      gid = 984;
+    };
+    users.forgejo-runner = {
+      uid = 989;
+      isSystemUser = true;
+      group = "forgejo-runner";
+      home = "/var/lib/forgejo-runner-agent";
+      createHome = true;
+    };
   };
 
   boot.loader = {
@@ -203,6 +213,41 @@ in
     };
   };
 
+  systemd.tmpfiles.rules = [
+    "d /var/lib/forgejo-runner-agent 0750 forgejo-runner forgejo-runner -"
+  ];
+
+  systemd.services.forgejo-runner-agent = {
+    description = "Forgejo Actions runner for every.channel";
+    after = [ "network-online.target" "forgejo.service" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+    path = with pkgs; [
+      bash
+      coreutils
+      curl
+      git
+      gnugrep
+      gnused
+      gnutar
+      gzip
+      nix
+      which
+      zstd
+    ];
+    environment = {
+      HOME = "/var/lib/forgejo-runner-agent";
+    };
+    serviceConfig = {
+      User = "forgejo-runner";
+      Group = "forgejo-runner";
+      WorkingDirectory = "/var/lib/forgejo-runner-agent";
+      ExecStart = "${pkgs.forgejo-runner}/bin/forgejo-runner --config /var/lib/forgejo-runner-agent/runner.yaml daemon";
+      Restart = "always";
+      RestartSec = "10s";
+    };
+  };
+
   services.caddy = {
     enable = true;
     email = "infra@every.channel";