diff --git a/nixos/module/hectic/service/gitea-runner-controller.nix b/nixos/module/hectic/service/gitea-runner-controller.nix
index 036da924..68c15c38 100644
--- a/nixos/module/hectic/service/gitea-runner-controller.nix
+++ b/nixos/module/hectic/service/gitea-runner-controller.nix
@@ -120,13 +120,13 @@ in
       };
       actRunnerVersion = lib.mkOption {
         type = lib.types.str;
-        default = "v0.2.11";
-        description = "act_runner release tag downloaded at VM bootstrap.";
+        default = "1.0.6";
+        description = "gitea-runner release version downloaded at VM bootstrap.";
       };
       actRunnerSha256 = lib.mkOption {
         type = lib.types.str;
-        default = "7a5e833793286bbfd9b59ce682bd41fc3f1c096bae1bb2a09b66ab2f6dacf90c";
-        description = "sha256 of the pinned act_runner linux-amd64 binary, verified at bootstrap.";
+        default = "d78ac11deed6580a2d88c1ef72c522aa7e2986d2d22b0d80edbee577b8f79b20";
+        description = "sha256 of the pinned gitea-runner linux-amd64 binary, verified at bootstrap.";
       };
       nixVersion = lib.mkOption {
         type = lib.types.str;
diff --git a/nixos/module/hectic/service/p4d.nix b/nixos/module/hectic/service/p4d.nix
index 0ad119e0..a04d6be8 100644
--- a/nixos/module/hectic/service/p4d.nix
+++ b/nixos/module/hectic/service/p4d.nix
@@ -340,6 +340,7 @@ in {
         User = serviceUser;
         Group = serviceGroup;
         WorkingDirectory = cfg.dataDir;
+        Environment = lib.mkIf cfg.ssl.enable "P4SSLDIR=${cfg.ssl.dir}";
         ExecStart = "${packageExe} ${lib.escapeShellArgs mainArgs}";
         Restart = "on-failure";
         RestartSec = "5s";
diff --git a/nixos/system/hectic-lab/hectic-lab.nix b/nixos/system/hectic-lab/hectic-lab.nix
index 86e695b8..84dd6d76 100644
--- a/nixos/system/hectic-lab/hectic-lab.nix
+++ b/nixos/system/hectic-lab/hectic-lab.nix
@@ -111,9 +111,9 @@ in {
       enable  = true;
       imageId = "424558114"; # MicroOS x86 + Hetzner datasource dhcpcd fix
       allowedRepos = [
-        "hectic-lab/util.nix"
-        "hectic-lab/runner-clean"
-        "hectic-lab/runner-clean2"
+        "hinterland/*"
+        "yukkop/*"
+        "hectic-lab/*"
       ];
       # FIXME(yukkop): debug key for bootstrap debugging; remove once E2E stable.
       debugSshPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJBLxMo5icX2Xyng7mcWGnIi+c4ZbVygjPhuU8noCkfZ yukkop@nixos";
diff --git a/package/gitea-runner-controller/controller.sh b/package/gitea-runner-controller/controller.sh
index db1b71a4..e54f93dd 100644
--- a/package/gitea-runner-controller/controller.sh
+++ b/package/gitea-runner-controller/controller.sh
@@ -88,7 +88,7 @@ gcr_alloc_deferred() {
     [ "$repo_active" -ge "${GCR_PER_REPO_CAP:-1}" ] && return 0
 
     gcr_budget_add "$rate" "$ttl_min" || return 0
-    reg_token="$(gcr_gitea_registration_token)" || return 0
+    reg_token="$(gcr_gitea_registration_token "$repo")" || return 0
 
     key="$(gcr_alloc_key "$job_id" "$attempt")"
     gcr_lock_acquire "$key" || return 0
@@ -174,6 +174,7 @@ gcr_bootstrap_pending() {
 
         job_id="$(gcr_record_field "$rec" job_id)"
         attempt="$(gcr_record_field "$rec" run_attempt)"
+        repo="$(gcr_record_field "$rec" repo)"
         label="$(gcr_record_field "$rec" label)"
         vm_id="$(gcr_record_field "$rec" vm_id)"
         runner_name="$(gcr_record_field "$rec" vm_name)"
@@ -181,7 +182,7 @@ gcr_bootstrap_pending() {
         ip="$(gcr_vm_public_ip "$vm_id")"
         [ -n "$ip" ] || continue
 
-        reg_token="$(gcr_gitea_registration_token)" || continue
+        reg_token="$(gcr_gitea_registration_token "$repo")" || continue
         ttl_min="$(gcr_record_field "$rec" ttl_min)"
 
         gcr_log info --ns=alloc "bootstrapping vm=$vm_id ip=$ip job=$job_id"
diff --git a/package/gitea-runner-controller/decide.sh b/package/gitea-runner-controller/decide.sh
index dcc867de..325f1b0d 100644
--- a/package/gitea-runner-controller/decide.sh
+++ b/package/gitea-runner-controller/decide.sh
@@ -18,7 +18,13 @@ gcr_repo_allowed() {
     oldIFS="$IFS"
     IFS=,
     for allowed in ${GCR_ALLOWED_REPOS:-}; do
-        if [ "$allowed" = "$repo" ]; then
+        suffix="${allowed#*/}"
+        if [ "$suffix" = "*" ]; then
+            prefix="${allowed%/*}/"
+            case "$repo" in
+                "$prefix"*) IFS="$oldIFS"; return 0 ;;
+            esac
+        elif [ "$allowed" = "$repo" ]; then
             IFS="$oldIFS"
             return 0
         fi
diff --git a/package/gitea-runner-controller/default.nix b/package/gitea-runner-controller/default.nix
index e8f9f1f3..76da5153 100644
--- a/package/gitea-runner-controller/default.nix
+++ b/package/gitea-runner-controller/default.nix
@@ -10,6 +10,7 @@
   gnugrep,
   gnused,
   openssl,
+  openssh,
 }:
 let
   shell = "${dash}/bin/dash";
@@ -33,6 +34,7 @@ let
     gnugrep
     gnused
     openssl
+    openssh
   ];
 
   lib = ''
diff --git a/package/gitea-runner-controller/gitea.sh b/package/gitea-runner-controller/gitea.sh
index af1fd96b..9f06c4f4 100644
--- a/package/gitea-runner-controller/gitea.sh
+++ b/package/gitea-runner-controller/gitea.sh
@@ -3,9 +3,12 @@
 # Requires: GCR_GITEA_URL, GITEA_REGISTRATION_TOKEN_FILE, GITEA_ADMIN_TOKEN_FILE
 
 gcr_gitea_registration_token() {
+    repo="$1"
     token="$(gcr_gitea_admin_token)" || return 1
+    owner="${repo%%/*}"
+    name="${repo#*/}"
     curl -fsS -X POST -H "Authorization: token $token" \
-        "$GCR_GITEA_URL/api/v1/orgs/hectic-lab/actions/runners/registration-token" \
+        "$GCR_GITEA_URL/api/v1/repos/$owner/$name/actions/runners/registration-token" \
         | jq -r '.token'
 }
 
diff --git a/package/gitea-runner-controller/hcloud.sh b/package/gitea-runner-controller/hcloud.sh
index 7719a87a..bb4ee15b 100644
--- a/package/gitea-runner-controller/hcloud.sh
+++ b/package/gitea-runner-controller/hcloud.sh
@@ -114,7 +114,7 @@ $(printf '%s\n' "$runner_config" | sed 's/^/      /')
   - path: /etc/systemd/system/gcr-bootstrap.service
     content: |
       [Unit]
-      Description=Bootstrap Nix + act_runner for ephemeral CI job
+      Description=Bootstrap gitea-runner for ephemeral CI job
       After=network-online.target
       Wants=network-online.target
       Before=gitea-runner.service
@@ -137,9 +137,9 @@ $(printf '%s\n' "$runner_config" | sed 's/^/      /')
       tar -xJf /tmp/nix.tar.xz -C /tmp
       /tmp/nix-$GCR_NIX_VERSION-x86_64-linux/install --no-daemon
       rm -rf /tmp/nix*
-      curl -fsSL \"https://gitea.com/gitea/act_runner/releases/download/$GCR_ACT_RUNNER_VERSION/act_runner-\$(printf '%s' \"$GCR_ACT_RUNNER_VERSION\" | sed 's/^v//')-linux-amd64\" -o /usr/local/bin/act_runner
-      printf '%s  /usr/local/bin/act_runner\n' \"$GCR_ACT_RUNNER_SHA256\" | sha256sum -c -
-      chmod 0755 /usr/local/bin/act_runner
+      curl -fsSL \"https://dl.gitea.com/gitea-runner/$GCR_ACT_RUNNER_VERSION/gitea-runner-$GCR_ACT_RUNNER_VERSION-linux-amd64\" -o /usr/local/bin/gitea-runner
+      printf '%s  /usr/local/bin/gitea-runner\n' \"$GCR_ACT_RUNNER_SHA256\" | sha256sum -c -
+      chmod 0755 /usr/local/bin/gitea-runner
       mkdir -p /var/lib/gitea-runner
 runcmd:
   - [ sh, -c, 'systemctl enable --now sshd.service 2>/dev/null || systemctl enable --now ssh 2>/dev/null || true' ]
@@ -246,9 +246,9 @@ cat > /usr/local/sbin/gcr-runner-start <<STARTEOF
 #!/bin/sh
 set -eu
 if [ ! -f /var/lib/gitea-runner/.runner ]; then
-  /usr/local/bin/act_runner register --no-interactive --instance $GCR_GITEA_URL --token $reg_token --name $runner_name --labels $label:host --config /etc/gitea-runner/config.yaml
+  /usr/local/bin/gitea-runner register --no-interactive --instance $GCR_GITEA_URL --token $reg_token --name $runner_name --labels $label:host --config /etc/gitea-runner/config.yaml
 fi
-exec /usr/local/bin/act_runner daemon --config /etc/gitea-runner/config.yaml
+exec /usr/local/bin/gitea-runner daemon --config /etc/gitea-runner/config.yaml
 STARTEOF
 chmod 0700 /usr/local/sbin/gcr-runner-start
 cat > /etc/systemd/system/gitea-runner.service <<UNITEOF
@@ -277,9 +277,9 @@ if [ "$label" = "nix" ]; then
   /tmp/nix-$GCR_NIX_VERSION-x86_64-linux/install --no-daemon
   rm -rf /tmp/nix*
 fi
-curl -fsSL "https://gitea.com/gitea/act_runner/releases/download/$GCR_ACT_RUNNER_VERSION/act_runner-\$(printf '%s' "$GCR_ACT_RUNNER_VERSION" | sed 's/^v//')-linux-amd64" -o /usr/local/bin/act_runner
-printf '%s  /usr/local/bin/act_runner\n' "$GCR_ACT_RUNNER_SHA256" | sha256sum -c -
-chmod 0755 /usr/local/bin/act_runner
+curl -fsSL "https://dl.gitea.com/gitea-runner/$GCR_ACT_RUNNER_VERSION/gitea-runner-$GCR_ACT_RUNNER_VERSION-linux-amd64" -o /usr/local/bin/gitea-runner
+printf '%s  /usr/local/bin/gitea-runner\n' "$GCR_ACT_RUNNER_SHA256" | sha256sum -c -
+chmod 0755 /usr/local/bin/gitea-runner
 INSEOF
 chmod 0700 /usr/local/sbin/gcr-install
 /usr/local/sbin/gcr-install
@@ -304,7 +304,7 @@ gcr_vm_bootstrap_ssh() {
     waited=0
     until ssh $SSH_OPTS "root@$ip" true 2>/dev/null; do
         waited=$((waited + 5))
-        [ "$waited" -ge 300 ] && {
+        [ "$waited" -ge 900 ] && {
             gcr_log warn --ns=hcloud "sshd never came up on $ip"
             rm -f "$key_tmp"
             return 1
diff --git a/package/gitea-runner-controller/state.sh b/package/gitea-runner-controller/state.sh
index aa447560..a98c7744 100644
--- a/package/gitea-runner-controller/state.sh
+++ b/package/gitea-runner-controller/state.sh
@@ -70,5 +70,5 @@ gcr_budget_add() {
 }
 
 gcr_active_records() {
-    grep -l '"status":"\(pending_vm\|vm_active\|deferred\)"' "$GCR_STATE_DIR"/jobs/*.json 2>/dev/null || true
+    grep -El '"status"[[:space:]]*:[[:space:]]*"(pending_vm|vm_active|deferred)"' "$GCR_STATE_DIR"/jobs/*.json 2>/dev/null || true
 }
diff --git a/package/gitea-runner-controller/webhook.sh b/package/gitea-runner-controller/webhook.sh
index aaf86062..99c53041 100644
--- a/package/gitea-runner-controller/webhook.sh
+++ b/package/gitea-runner-controller/webhook.sh
@@ -136,7 +136,7 @@ gcr_alloc() {
         return 0
     fi
 
-    reg_token="$(gcr_gitea_registration_token)" || {
+    reg_token="$(gcr_gitea_registration_token "$repo")" || {
         gcr_record_del "$job_id" "$attempt"
         gcr_lock_release "$key"
         gcr_event "token-error" "$job_id" "{}"