diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 8382282..77b18be 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -105,8 +105,14 @@ jobs:
           # Kaniko clones the context itself (this job has no node for JS actions
           # like checkout). `dev` is the moving branch tag; the commit SHA is the
           # immutable ref the moby Deployment pins by digest.
+          # The runtime stage is `FROM scratch` + `COPY /rootfs /`, so Kaniko
+          # rebuilds the container root. The act runner bind-mounts /var/run/act
+          # into the job container; Kaniko can't unlink that busy mount while
+          # laying down the rootfs (unlinkat ... device or resource busy), so
+          # ignore it. It is a runner artifact and must not be in the image.
           /kaniko/executor \
             --context "git://${REGISTRY}/moby/brewlog.git#refs/heads/dev" \
             --dockerfile Dockerfile \
+            --ignore-path=/var/run/act \
             --destination "${IMAGE}:${GITHUB_SHA}" \
             --destination "${IMAGE}:dev"