diff --git a/tool/setup_ci_runner.sh b/tool/setup_ci_runner.sh
index 0d629ec..8ba3abb 100755
--- a/tool/setup_ci_runner.sh
+++ b/tool/setup_ci_runner.sh
@@ -168,15 +168,22 @@ fi
 # ── Config ─────────────────────────────────────────────────────────────────
 say "Config"
 CONFIG="$RUNNER_HOME/config.yaml"
-if [[ -f "$CONFIG" ]]; then
-    echo "  $CONFIG exists, leaving it alone"
+if [[ -f "$CONFIG" && -f "$RUNNER_HOME/.runner" ]]; then
+    # Registered: this config is in use, do not touch it.
+    echo "  $CONFIG exists and the runner is registered — leaving it alone"
 else
+    if [[ -f "$CONFIG" ]]; then
+        echo "  $CONFIG exists but nothing is registered yet — rewriting it"
+    fi
     cat > "$CONFIG" <<YAML
 log:
   level: info
 
 runner:
-  file: .runner
+  # Absolute on purpose: a relative path resolves against whatever directory
+  # the command was invoked from, which for `register` is wherever the admin
+  # happened to be standing — typically a repo this account cannot write.
+  file: ${RUNNER_HOME}/.runner
   # One at a time: a 2-ABI NDK compile plus Gradle will saturate this box, and
   # concurrent jobs would only contend for it.
   capacity: 1
@@ -208,14 +215,16 @@ if [[ -f "$RUNNER_HOME/.runner" ]]; then
     echo "  already registered ($RUNNER_HOME/.runner) — skipping."
     echo "  To re-register: delete that file AND remove the runner in Gitea."
 else
-    sudo -u "$RUNNER_USER" HOME="$RUNNER_HOME" \
-        "$BIN" register \
-            --no-interactive \
-            --instance "$INSTANCE" \
-            --token "$RUNNER_TOKEN" \
-            --name "$RUNNER_NAME" \
-            --labels "${LABEL}:host" \
-            --config "$CONFIG"
+    # Run from the runner's own directory: register writes .runner and
+    # .runner.lock relative to cwd unless told otherwise, and this account
+    # cannot write wherever the admin invoked the script from.
+    # --labels is deliberately absent: gitea-runner ignores it when the config
+    # file defines labels, and warns that it is doing so.
+    sudo -u "$RUNNER_USER" env HOME="$RUNNER_HOME" sh -c '
+        cd "$1" || exit 1
+        exec "$2" register --no-interactive \
+            --instance "$3" --token "$4" --name "$5" --config "$6"
+    ' sh "$RUNNER_HOME" "$BIN" "$INSTANCE" "$RUNNER_TOKEN" "$RUNNER_NAME" "$CONFIG"
     # register writes .runner into the cwd it was given; make sure it landed.
     [[ -f "$RUNNER_HOME/.runner" ]] || {
         echo "  registration produced no .runner in $RUNNER_HOME" >&2