diff --git a/Dockerfile b/Dockerfile
index e317703..45d6850 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -62,6 +62,14 @@ RUN useradd --root /rootfs -u 1000 -U -M -s /bin/false brewlog \
     && mkdir -p /rootfs/home/brewlog /rootfs/data \
     && chown 1000:1000 /rootfs/home/brewlog /rootfs/data
 
+# chisel's base-files ships /var/run as a symlink to /run. When the CI builder
+# (Kaniko) lays this rootfs onto `/` for the scratch stage, replacing that
+# symlink forces a RemoveAll of the destination /var/run — which on the Forgejo
+# act runner is a directory holding a busy /var/run/act bind-mount, so the copy
+# fails with "unlinkat /var/run/act: device or resource busy". The runtime image
+# does not need /var/run, so drop the symlink to avoid the collision.
+RUN rm -rf /rootfs/var/run
+
 # ---------------------------------------------------------------------------
 # Runtime — scratch with chisel rootfs
 # ---------------------------------------------------------------------------