diff --git a/infra/deploy/forgejo/register-lan-runner.sh b/infra/deploy/forgejo/register-lan-runner.sh
index 0f96f97..1296a1c 100755
--- a/infra/deploy/forgejo/register-lan-runner.sh
+++ b/infra/deploy/forgejo/register-lan-runner.sh
@@ -82,6 +82,11 @@ After=network-online.target
 
 [Service]
 WorkingDirectory=${RUNNER_DIR}
+# CI job steps shell out to user-installed tools (sops, age, ...) that live in
+# ~/.local/bin, not on systemd --user's default PATH. Without this, any
+# workflow that needs one (e.g. render-secrets.sh once a host is
+# SOPS-configured) fails with "not installed" even though it plainly is.
+Environment=PATH=%h/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
 ExecStart=${RUNNER_DIR}/forgejo-runner daemon -c config.yaml
 Restart=on-failure
 RestartSec=5