diff --git a/ansible/host_vars/ci-01.lab.alexpires.me.yml b/ansible/host_vars/ci-01.lab.alexpires.me.yml
index a55d044..648cc87 100644
--- a/ansible/host_vars/ci-01.lab.alexpires.me.yml
+++ b/ansible/host_vars/ci-01.lab.alexpires.me.yml
@@ -119,24 +119,9 @@ windows_gitea_runner_podman_runners:
     config_file: "D:\\GiteaRunner\\cicd-base\\config.yaml"
     data_dir: "D:\\GiteaRunner\\cicd-base\\data"
     log_dir: "D:\\Logs\\GiteaRunner\\cicd-base"
-  - profile: infra-tools
-    name: "gitea-runner-infra-tools"
-    container_name: "gitea-runner-infra-tools"
-    image: "local/gitea-runner:infra-tools"
-    dockerfile_src: "Dockerfile.infra-tools"
-    labels: "linux:host,infra-tools"
-    config_file: "D:\\GiteaRunner\\infra-tools\\config.yaml"
-    data_dir: "D:\\GiteaRunner\\infra-tools\\data"
-    log_dir: "D:\\Logs\\GiteaRunner\\infra-tools"
-  - profile: security-scan
-    name: "gitea-runner-security-scan"
-    container_name: "gitea-runner-security-scan"
-    image: "local/gitea-runner:security-scan"
-    dockerfile_src: "Dockerfile.security-scan"
-    labels: "linux:host,security-scan"
-    config_file: "D:\\GiteaRunner\\security-scan\\config.yaml"
-    data_dir: "D:\\GiteaRunner\\security-scan\\data"
-    log_dir: "D:\\Logs\\GiteaRunner\\security-scan"
+    run_args:
+      - "--privileged"
+    enable_nested_build: true
   - profile: cpp-build
     name: "gitea-runner-cpp-build"
     container_name: "gitea-runner-cpp-build"
@@ -155,18 +140,6 @@ windows_gitea_runner_podman_runners:
     config_file: "D:\\GiteaRunner\\go-build\\config.yaml"
     data_dir: "D:\\GiteaRunner\\go-build\\data"
     log_dir: "D:\\Logs\\GiteaRunner\\go-build"
-  - profile: image-build
-    name: "gitea-runner-image-build"
-    container_name: "gitea-runner-image-build"
-    image: "local/gitea-runner:image-build"
-    dockerfile_src: "Dockerfile.image-build"
-    labels: "linux:host,image-build"
-    config_file: "D:\\GiteaRunner\\image-build\\config.yaml"
-    data_dir: "D:\\GiteaRunner\\image-build\\data"
-    log_dir: "D:\\Logs\\GiteaRunner\\image-build"
-    run_args:
-      - "--privileged"
-    enable_nested_build: true
 
 windows_gitea_runner_windows_instance_url: "https://code.alexpires.me"
 windows_gitea_runner_windows_registration_token: "{{ lookup('env', 'GITEA_RUNNER_REGISTRATION_TOKEN') }}"
diff --git a/ansible/roles/windows_gitea_runner_podman/tasks/main.yml b/ansible/roles/windows_gitea_runner_podman/tasks/main.yml
index 6e15ef5..2076978 100644
--- a/ansible/roles/windows_gitea_runner_podman/tasks/main.yml
+++ b/ansible/roles/windows_gitea_runner_podman/tasks/main.yml
@@ -180,3 +180,90 @@
       {{ windows_gitea_runner_podman_runner.name | default(windows_gitea_runner_podman_runner.profile) }}
   tags:
     - roles::windows_gitea_runner_podman::linux
+
+- name: Collect running Gitea runner container names
+  ansible.windows.win_shell: |
+    $ErrorActionPreference = "Stop"
+    $podman = "{{ windows_gitea_runner_podman_install_dir }}\podman.exe"
+
+    $raw = & $podman ps -a --filter label=io.a13labs.gitea_runner.config_hash --format json 2>$null
+    if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($raw)) {
+      Write-Output "[]"
+      exit 0
+    }
+
+    $containers = ($raw | ConvertFrom-Json)
+    $names = @()
+    foreach ($c in $containers) {
+      $names += $c.Names
+    }
+    ($names | ConvertTo-Json -Compress)
+  become: true
+  become_method: ansible.builtin.runas
+  become_user: "{{ windows_gitea_runner_podman_service_user }}"
+  register: __windows_gitea_runner_podman_existing_containers
+  changed_when: false
+  tags:
+    - roles::windows_gitea_runner_podman::linux
+
+- name: Resolve defined container names with defaults
+  ansible.builtin.set_fact:
+    __windows_gitea_runner_podman_defined_containers: >-
+      {{
+        __windows_gitea_runner_podman_defined_containers | default([]) + [
+          __windows_gitea_runner_podman_item.container_name
+          | default(
+              'gitea-runner-' ~ (
+                  __windows_gitea_runner_podman_item.profile
+                  | default(__windows_gitea_runner_podman_item.name | default('runner'))
+              )
+            )
+        ]
+      }}
+  loop: "{{ windows_gitea_runner_podman_runners }}"
+  loop_control:
+    loop_var: __windows_gitea_runner_podman_item
+  tags:
+    - roles::windows_gitea_runner_podman::linux
+
+- name: Identify stale Gitea runner containers
+  ansible.builtin.set_fact:
+    __windows_gitea_runner_podman_stale_containers: >-
+      {{
+        (__windows_gitea_runner_podman_existing_containers.stdout | from_json)
+        | list
+        | reject('in', __windows_gitea_runner_podman_defined_containers)
+        | list
+      }}
+  tags:
+    - roles::windows_gitea_runner_podman::linux
+
+- name: Remove stale Gitea runner containers
+  ansible.windows.win_shell: |
+    $ErrorActionPreference = "Stop"
+    $podman = "{{ windows_gitea_runner_podman_install_dir }}\podman.exe"
+    $name = "{{ item }}"
+    & $podman rm -f $name 2>$null
+    if ($LASTEXITCODE -eq 0) {
+      Write-Output "__REMOVED__:$name"
+    }
+  become: true
+  become_method: ansible.builtin.runas
+  become_user: "{{ windows_gitea_runner_podman_service_user }}"
+  loop: "{{ __windows_gitea_runner_podman_stale_containers }}"
+  loop_control:
+    label: "{{ item }}"
+  register: __windows_gitea_runner_podman_stale_removal
+  changed_when: true
+  failed_when: false
+  when: __windows_gitea_runner_podman_stale_containers | length > 0
+  tags:
+    - roles::windows_gitea_runner_podman::linux
+
+- name: Report stale container cleanup
+  ansible.builtin.debug:
+    msg: >-
+      Stale containers removed: {{ __windows_gitea_runner_podman_stale_containers | join(', ') }}
+  when: __windows_gitea_runner_podman_stale_containers | length > 0
+  tags:
+    - roles::windows_gitea_runner_podman::linux
diff --git a/ansible/roles/windows_gitea_runner_podman/tasks/runner.yml b/ansible/roles/windows_gitea_runner_podman/tasks/runner.yml
index 5385fe1..63f0c97 100644
--- a/ansible/roles/windows_gitea_runner_podman/tasks/runner.yml
+++ b/ansible/roles/windows_gitea_runner_podman/tasks/runner.yml
@@ -361,7 +361,8 @@
       -e "GITEA_RUNNER_REGISTRATION_TOKEN={{ windows_gitea_runner_podman_registration_token }}" `
       -e "GITEA_RUNNER_NAME={{ __windows_gitea_runner_podman_name }}" `
       -e "GITEA_RUNNER_LABELS={{ __windows_gitea_runner_podman_labels }}" `
-    {% if __windows_gitea_runner_podman_enable_nested_build %}
+      -e "GITEA_RUNNER_USER=runner" `
+      {% if __windows_gitea_runner_podman_enable_nested_build %}
       -v "{{ __windows_gitea_runner_podman_storage_dir }}:/var/lib/containers" `
       -e "BUILDAH_ISOLATION=chroot" `
       -e "STORAGE_DRIVER=vfs" `