diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
new file mode 100644
index 0000000..99eea46
--- /dev/null
+++ b/.gitea/workflows/build.yml
@@ -0,0 +1,22 @@
+name: build
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: docker/login-action@v3
+        with:
+          registry: git.studiovita.li
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+      - uses: docker/build-push-action@v6
+        with:
+          context: images/act
+          push: true
+          tags: git.studiovita.li/studio/actions:ubuntu-latest
diff --git a/images/act/Dockerfile b/images/act/Dockerfile
new file mode 100644
index 0000000..b906e9e
--- /dev/null
+++ b/images/act/Dockerfile
@@ -0,0 +1,15 @@
+FROM docker.gitea.com/runner-images:ubuntu-latest
+
+## renovate: datasource=github-releases depName=getsops/sops
+ARG SOPS_VERSION=v3.13.3
+
+RUN set -eux; \
+    arch=$(dpkg --print-architecture); \
+    asset="sops-${SOPS_VERSION}.linux.${arch}"; \
+    url="https://github.com/getsops/sops/releases/download/${SOPS_VERSION}"; \
+    curl -fsSL -o "/tmp/$asset" "$url/$asset"; \
+    curl -fsSL -o /tmp/checksums.txt "$url/sops-${SOPS_VERSION}.checksums.txt"; \
+    (cd /tmp && grep " ${asset}$" checksums.txt | sha256sum -c -); \
+    install -m 0755 "/tmp/$asset" /usr/local/bin/sops; \
+    rm -f "/tmp/$asset" /tmp/checksums.txt; \
+    sops --version
diff --git a/images/act/README.md b/images/act/README.md
new file mode 100644
index 0000000..bf45571
--- /dev/null
+++ b/images/act/README.md
@@ -0,0 +1,5 @@
+# act runner image
+
+Gitea / Forgejo Actions runner image based on `runner-images:ubuntu-latest` with the pinned, checksum-verified SOPS build installed.
+
+Built and pushed to `git.studiovita.li/studio/actions:ubuntu-latest` by the `build` workflow on push to `main`. Update `SOPS_VERSION` in `Dockerfile` to bump SOPS (tracked in renovate.json).
\ No newline at end of file
diff --git a/renovate.json b/renovate.json
index 8fe94d4..d1f00c2 100644
--- a/renovate.json
+++ b/renovate.json
@@ -13,6 +13,14 @@
         "#+\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)\\s+[A-Z0-9_]+\\s*:\\s*[\"']?(?<currentValue>[^\\s\"'#]+)[\"']?"
       ],
       "description": "match any pinned dependency using SCREAMING_SNAKE_CASE naming as ENV"
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["**/Dockerfile"],
+      "matchStrings": [
+        "#+\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)[ \\t]*\\n[ \\t]*ARG\\s+[A-Z0-9_]+=(?<currentValue>[^\\s\"'#]+)"
+      ],
+      "description": "match pinned ARG deps in Dockerfiles"
     }
   ]
 }