diff --git a/infrastructure-provisioning/on-prem/talos/talconfig.yaml b/infrastructure-provisioning/on-prem/talos/talconfig.yaml
index 5ed08cb7..1ff61a2c 100644
--- a/infrastructure-provisioning/on-prem/talos/talconfig.yaml
+++ b/infrastructure-provisioning/on-prem/talos/talconfig.yaml
@@ -1,7 +1,7 @@
 clusterName: opcluster
 
-talosVersion: v1.5.1
-kubernetesVersion: 1.28.0
+talosVersion: v1.5.2
+kubernetesVersion: 1.28.2
 endpoint: "https://opcluster.homelab.danmanners.com:6443"
 
 cniConfig:
diff --git a/manifests/workloads/gitea/database/git-cluster.yaml b/manifests/workloads/gitea/database/git-cluster.yaml
index 95328024..2ecfe6e8 100644
--- a/manifests/workloads/gitea/database/git-cluster.yaml
+++ b/manifests/workloads/gitea/database/git-cluster.yaml
@@ -7,7 +7,7 @@ spec:
   instances: 2
   primaryUpdateStrategy: unsupervised
   storage:
-    size: 30Gi
+    size: 40Gi
     storageClass: ceph-rbd
   superuserSecret:
     name: gitdb-superuser
diff --git a/manifests/workloads/gitea/runners/deployment.yaml b/manifests/workloads/gitea/runners/deployment.yaml
new file mode 100644
index 00000000..0fc82bcf
--- /dev/null
+++ b/manifests/workloads/gitea/runners/deployment.yaml
@@ -0,0 +1,85 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: gitea-runner
+  namespace: git
+  labels:
+    gitea-runner: ''
+spec:
+  serviceAccountName: grt
+  restartPolicy: OnFailure
+  initContainers:
+  - name: fetch-runner-token
+    image: init-container-image
+    command: ["ash", "-c"]
+    args:
+    - |
+      apk add --no-cache curl 2>&1 >/dev/null
+      export ARCH=$(uname -m | awk '{print ($1=="x86_64" ? "amd64" : ($1=="aarch64" ? "arm64" : "unknown"))}')
+      curl -sLO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl" 2>&1 >/dev/null
+      chmod +x ./kubectl 2>&1 >/dev/null
+      ./kubectl exec -n git deployments/gitea -c gitea -- gitea actions grt > /token/GITEA_RUNNER_REGISTRATION_TOKEN
+      echo "Registration Token: $(cat /token/GITEA_RUNNER_REGISTRATION_TOKEN)"
+    resources: {}
+    volumeMounts:
+    - name: token
+      mountPath: /token
+  containers:
+  - name: runner
+    image: runner-image
+    command: ["sh", "-c", "while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...'; sleep 5; done; /sbin/tini -- /opt/act/run.sh"]
+    env:
+    - name: DOCKER_HOST
+      value: tcp://localhost:2376
+    - name: DOCKER_CERT_PATH
+      value: /certs/client
+    - name: DOCKER_TLS_VERIFY
+      value: "1"
+    - name: GITEA_INSTANCE_URL
+      value: http://gitea-http.git.svc.cluster.local:3000
+    - name: GITEA_RUNNER_REGISTRATION_TOKEN_FILE
+      value: /token/GITEA_RUNNER_REGISTRATION_TOKEN
+    resources: {}
+    volumeMounts:
+    - name: token
+      mountPath: /token
+    - name: docker-certs
+      mountPath: /certs
+    - name: runner-data
+      mountPath: /data
+    terminationMessagePath: /dev/termination-log
+    terminationMessagePolicy: File
+    imagePullPolicy: Always
+  - name: daemon
+    image: docker-daemon-image
+    resources: {}
+    env:
+    - name: DOCKER_TLS_CERTDIR
+      value: /certs
+    securityContext:
+      privileged: true
+    volumeMounts:
+    - name: docker-certs
+      mountPath: /certs
+    terminationMessagePath: /dev/termination-log
+    terminationMessagePolicy: File
+    imagePullPolicy: IfNotPresent
+  volumes:
+  - name: docker-certs
+    emptyDir: {}
+  - name: runner-data
+    persistentVolumeClaim:
+      claimName: act-runner-vol
+  - name: token
+    emptyDir: {}
+  terminationGracePeriodSeconds: 30
+  securityContext: {}
+  tolerations:
+  - key: node.kubernetes.io/not-ready
+    operator: Exists
+    effect: NoExecute
+    tolerationSeconds: 300
+  - key: node.kubernetes.io/unreachable
+    operator: Exists
+    effect: NoExecute
+    tolerationSeconds: 300
diff --git a/manifests/workloads/gitea/runners/kustomization.yaml b/manifests/workloads/gitea/runners/kustomization.yaml
index 96c3a309..e2d2d60d 100644
--- a/manifests/workloads/gitea/runners/kustomization.yaml
+++ b/manifests/workloads/gitea/runners/kustomization.yaml
@@ -7,3 +7,14 @@ resources:
 - pod.yaml
 - pvc.yaml
 - rbac-test-job.yaml
+
+images:
+- name: init-container-image
+  newName: core.harbor.homelab.danmanners.com/docker.io/library/alpine
+  newTag: latest
+- name: runner-image
+  newName: core.harbor.homelab.danmanners.com/docker.io/gitea/act_runner
+  newTag: nightly
+- name: docker-daemon-image
+  newName: core.harbor.homelab.danmanners.com/docker.io/library/docker
+  newTag: 23.0.6-dind
diff --git a/manifests/workloads/gitea/runners/pod.yaml b/manifests/workloads/gitea/runners/pod.yaml
index 410908e6..0fc82bcf 100644
--- a/manifests/workloads/gitea/runners/pod.yaml
+++ b/manifests/workloads/gitea/runners/pod.yaml
@@ -10,7 +10,7 @@ spec:
   restartPolicy: OnFailure
   initContainers:
   - name: fetch-runner-token
-    image: core.harbor.homelab.danmanners.com/docker.io/library/alpine:latest
+    image: init-container-image
     command: ["ash", "-c"]
     args:
     - |
@@ -19,13 +19,14 @@ spec:
       curl -sLO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl" 2>&1 >/dev/null
       chmod +x ./kubectl 2>&1 >/dev/null
       ./kubectl exec -n git deployments/gitea -c gitea -- gitea actions grt > /token/GITEA_RUNNER_REGISTRATION_TOKEN
+      echo "Registration Token: $(cat /token/GITEA_RUNNER_REGISTRATION_TOKEN)"
     resources: {}
     volumeMounts:
     - name: token
       mountPath: /token
   containers:
   - name: runner
-    image: core.harbor.homelab.danmanners.com/docker.io/gitea/act_runner:nightly
+    image: runner-image
     command: ["sh", "-c", "while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...'; sleep 5; done; /sbin/tini -- /opt/act/run.sh"]
     env:
     - name: DOCKER_HOST
@@ -38,7 +39,6 @@ spec:
       value: http://gitea-http.git.svc.cluster.local:3000
     - name: GITEA_RUNNER_REGISTRATION_TOKEN_FILE
       value: /token/GITEA_RUNNER_REGISTRATION_TOKEN
-      # Mount the secret from the init container
     resources: {}
     volumeMounts:
     - name: token
@@ -51,7 +51,7 @@ spec:
     terminationMessagePolicy: File
     imagePullPolicy: Always
   - name: daemon
-    image: core.harbor.homelab.danmanners.com/docker.io/library/docker:23.0.6-dind
+    image: docker-daemon-image
     resources: {}
     env:
     - name: DOCKER_TLS_CERTDIR
diff --git a/manifests/workloads/gitea/values.yaml b/manifests/workloads/gitea/values.yaml
index a76e8476..a321bc1c 100644
--- a/manifests/workloads/gitea/values.yaml
+++ b/manifests/workloads/gitea/values.yaml
@@ -1,4 +1,4 @@
-replicaCount: 2
+replicaCount: 1 # Without a RWX storageclass, we can't run more than one replica. RIParoni-Pepperoni.
 
 global:
   imageRegistry: core.harbor.homelab.danmanners.com/docker.io
@@ -8,24 +8,20 @@ global:
 #   rootless: false
 
 persistence:
-  storageClass: cephfs
-  size: 40Gi
+  storageClass: ceph-rbd
+  size: 60Gi
   accessModes:
-  - ReadWriteMany
+  - ReadWriteOnce
 
 strategy:
-  type: RollingUpdate
-  maxUnavailable: 1
-  # type: Recreate
+  type: Recreate # Cant use RollingUpdate because we only have one replica.
+  maxUnavailable: 0 # Can't use 1 because we only have one replica.
 
 gitea:
   admin:
     existingSecret: gitea-creds
   config:
     APP_NAME: "Not Your Mommas's GitHub"
-    # server:
-    #   SSH_PORT: 2222
-    #   SSH_LISTEN_PORT: 2222
     cron.GIT_GC_REPOS:
       ENABLED: false
   additionalConfigSources: