diff --git a/agenix/hosts/tanker/config.nix b/agenix/hosts/tanker/config.nix
index e3d3a24..95eb1bd 100644
--- a/agenix/hosts/tanker/config.nix
+++ b/agenix/hosts/tanker/config.nix
@@ -27,6 +27,10 @@
       file = ./fedifetcher/config.age;
     };
 
+    forgejo-actions-token = {
+      file = ./forgejo-actions/token.age;
+    };
+
     linkding-environment = {
       file = ./linkding/environment.age;
     };
diff --git a/agenix/hosts/tanker/forgejo-actions/token.age b/agenix/hosts/tanker/forgejo-actions/token.age
new file mode 100644
index 0000000..ceb7f47
--- /dev/null
+++ b/agenix/hosts/tanker/forgejo-actions/token.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 MtGp6g j3LJbMvC+F+WI80vay1mUtT4AU/iPrVlJspYtDwL5WI
+JllJKpMrJtNEF2Wjlt+FQZjt0HYg1jcM5Z23Nyr0JDQ
+-> ssh-ed25519 iO8/4g M2tItsaOdbUwDrIR6CniYnQtmdgLBL31D/xdYI27DR4
+hdQhMFbQ88Qd0b9/yUqSCp0jmWBVTamHRHxvfzMKQd0
+-> a88u-grease %<;6}T6g dP%)[l 5M?k?Ff
+66xUudBfSs81QpoQPElEtQ9W5IUdTpeO613+2nVdnOVb
+--- +iZj/5A8YtvHw9xzvg95+S7aYwRvA87KYF8fsZyuORk
+ÿ§Zh§è#ÊÖÆ&BÕÓ÷îÈKe¡Z`×òŠýD$;TH,ß¡Àì³ÏÿÓL´×%à•ŒƒÈX©Høh$8‚€Ù³„)ÊŒ
÷HàX<qã
\ No newline at end of file
diff --git a/hardware/hosts/tanker.nix b/hardware/hosts/tanker.nix
index c9689e8..4c3362d 100644
--- a/hardware/hosts/tanker.nix
+++ b/hardware/hosts/tanker.nix
@@ -22,6 +22,13 @@
       kernelModules = [ "kvm-amd" "tls" ];
     };
 
+    swraid = {
+      enable = true;
+      mdadmConf = ''
+        MAILADDR daniel+tanker@kempkens.io
+      '';
+    };
+
     kernelPackages = pkgs.zfs.latestCompatibleLinuxPackages;
     kernelModules = [ "tcp_bbr" ];
 
diff --git a/secrets.nix b/secrets.nix
index ec8eb73..779a44f 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -25,6 +25,8 @@ in
 
   "agenix/hosts/tanker/fedifetcher/config.age".publicKeys = tanker;
 
+  "agenix/hosts/tanker/forgejo-actions/token.age".publicKeys = tanker;
+
   "agenix/hosts/tanker/mastodon/databasePassword.age".publicKeys = tanker;
   "agenix/hosts/tanker/mastodon/smtpPassword.age".publicKeys = tanker;
   "agenix/hosts/tanker/mastodon/otpSecret.age".publicKeys = tanker;
diff --git a/system/nixos/forgejo.nix b/system/nixos/forgejo.nix
index f37250d..0e4f66a 100644
--- a/system/nixos/forgejo.nix
+++ b/system/nixos/forgejo.nix
@@ -1,66 +1,91 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 
 let
   fqdn = "git.kempkens.io";
 in
 {
-  services.gitea = {
-    enable = true;
-    package = pkgs.forgejo;
+  services = {
+    gitea = {
+      enable = true;
+      package = pkgs.forgejo;
 
-    stateDir = "/var/lib/forgejo";
+      stateDir = "/var/lib/forgejo";
 
-    database = {
-      type = "postgres";
-    };
-
-    lfs.enable = true;
-
-    appName = "kempkens.io Forge";
-
-    settings = {
-      server = {
-        PROTOCOL = "http+unix";
-        DOMAIN = fqdn;
-        ROOT_URL = "https://${fqdn}/";
+      database = {
+        type = "postgres";
       };
 
-      service = {
-        DISABLE_REGISTRATION = true;
-      };
+      lfs.enable = true;
 
-      mailer = {
-        ENABLED = true;
-        PROTOCOL = "sendmail";
-        FROM = "forgejo@mg.kempkens.io";
-        SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
-      };
+      appName = "kempkens.io Forge";
 
-      session = {
-        COOKIE_SECURE = true;
-        SAME_SITE = "strict";
-      };
+      settings = {
+        server = {
+          PROTOCOL = "http+unix";
+          DOMAIN = fqdn;
+          ROOT_URL = "https://${fqdn}/";
+        };
 
-      repository = {
-        DISABLE_HTTP_GIT = true;
-      };
+        service = {
+          DISABLE_REGISTRATION = true;
+        };
 
-      other = {
-        SHOW_FOOTER_VERSION = false;
+        mailer = {
+          ENABLED = true;
+          PROTOCOL = "sendmail";
+          FROM = "forgejo@mg.kempkens.io";
+          SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
+        };
+
+        session = {
+          COOKIE_SECURE = true;
+          SAME_SITE = "strict";
+        };
+
+        repository = {
+          DISABLE_HTTP_GIT = true;
+        };
+
+        actions = {
+          ENABLED = true;
+        };
+
+        other = {
+          SHOW_FOOTER_VERSION = false;
+        };
       };
     };
-  };
 
-  services.nginx.virtualHosts."${fqdn}" = {
-    quic = true;
-    http3 = true;
+    gitea-actions-runner = {
+      package = pkgs.forgejo-actions-runner;
 
-    onlySSL = true;
-    useACMEHost = "kempkens.io";
+      instances = {
+        tanker = {
+          enable = true;
+          url = "https://${fqdn}";
 
-    locations."/" = {
-      recommendedProxySettings = true;
-      proxyPass = "http://unix:/run/gitea/gitea.sock";
+          name = "tanker";
+          tokenFile = config.age.secrets.forgejo-actions-token.path;
+
+          labels = [
+            "debian-bullseye:docker://node:18-bullseye"
+            "debian-bookworm:docker://node:18-bookworm"
+          ];
+        };
+      };
+    };
+
+    nginx.virtualHosts."${fqdn}" = {
+      quic = true;
+      http3 = true;
+
+      onlySSL = true;
+      useACMEHost = "kempkens.io";
+
+      locations."/" = {
+        recommendedProxySettings = true;
+        proxyPass = "http://unix:/run/gitea/gitea.sock";
+      };
     };
   };
 }