diff --git a/.forgejo/workflows/build-iso.yml b/.forgejo/workflows/build-iso.yml
index ceb688b..67c3224 100644
--- a/.forgejo/workflows/build-iso.yml
+++ b/.forgejo/workflows/build-iso.yml
@@ -14,14 +14,13 @@ concurrency:
 
 jobs:
   build-iso:
-    runs-on: ubuntu-latest
+    # Run directly on the runner host, not inside a job container.
+    # `build.sh` does `docker run -v $REPO_ROOT:/work archlinux:latest`,
+    # and host docker interprets the volume source as a host path — so
+    # $REPO_ROOT has to be a path on the host, which it only is when
+    # we skip the job-container wrapping. The runner VM has git + docker.
+    runs-on: self-hosted
     timeout-minutes: 30
-    # The runner is configured for docker-outside-of-docker: its
-    # `valid_volumes` whitelists /var/run/docker.sock and it mounts the
-    # socket into every job container automatically — no need to repeat
-    # that mount here (it'd be a duplicate-mount error).
-    env:
-      DOCKER_HOST: unix:///var/run/docker.sock
     steps:
       - uses: actions/checkout@v4