diff --git a/.forgejo/workflows/build-iso.yml b/.forgejo/workflows/build-iso.yml
index a244c4a..d428cad 100644
--- a/.forgejo/workflows/build-iso.yml
+++ b/.forgejo/workflows/build-iso.yml
@@ -16,14 +16,16 @@ jobs:
   build-iso:
     runs-on: ubuntu-latest
     timeout-minutes: 30
-    # DOCKER_HOST points the docker CLI at the DinD sidecar. The sidecar's
-    # hostname is DNS-resolvable because forgejo-runner is configured with
-    # `container.network: "forgejo-runner_default"`, which attaches every
-    # job container to the shared network where docker-in-docker lives.
-    # The default `ubuntu-latest` image (catthehacker/ubuntu:act-latest)
-    # already ships the docker CLI.
+    # The runner is configured for docker-outside-of-docker: it mounts the
+    # host's /var/run/docker.sock. Jobs get the same socket so the
+    # `docker run` inside build.sh talks to the host daemon directly,
+    # no DinD gymnastics.
+    container:
+      image: catthehacker/ubuntu:act-latest
+      volumes:
+        - /var/run/docker.sock:/var/run/docker.sock
     env:
-      DOCKER_HOST: tcp://docker-in-docker:2375
+      DOCKER_HOST: unix:///var/run/docker.sock
     steps:
       - uses: actions/checkout@v4