diff --git a/ansible/roles/gitea_runner/tasks/healthcheck.yml b/ansible/roles/gitea_runner/tasks/healthcheck.yml
index 30bd8c7..a99374d 100644
--- a/ansible/roles/gitea_runner/tasks/healthcheck.yml
+++ b/ansible/roles/gitea_runner/tasks/healthcheck.yml
@@ -40,24 +40,22 @@
     mode: "0644"
 
 - name: Reload systemd user daemon for healthcheck timer
-  ansible.builtin.command: systemctl --user daemon-reload
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user daemon-reload
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists
     - gitea_runner_docker_rootless_setup
 
 - name: Enable and start healthcheck user timer
-  ansible.builtin.command: systemctl --user enable --now runner-healthcheck.timer
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user enable --now runner-healthcheck.timer
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists
diff --git a/ansible/roles/gitea_runner/tasks/prune.yml b/ansible/roles/gitea_runner/tasks/prune.yml
index 245b17c..a5a81ea 100644
--- a/ansible/roles/gitea_runner/tasks/prune.yml
+++ b/ansible/roles/gitea_runner/tasks/prune.yml
@@ -18,12 +18,11 @@
   register: gitea_runner_prune_timer
 
 - name: Reload systemd user daemon for prune timer
-  ansible.builtin.command: systemctl --user daemon-reload
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user daemon-reload
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists
@@ -31,12 +30,11 @@
     - gitea_runner_prune_service is changed or gitea_runner_prune_timer is changed
 
 - name: Enable and start docker-prune user timer
-  ansible.builtin.command: systemctl --user enable --now docker-prune.timer
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user enable --now docker-prune.timer
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists
diff --git a/ansible/roles/gitea_runner/tasks/register.yml b/ansible/roles/gitea_runner/tasks/register.yml
index d0a9248..9ae4b77 100644
--- a/ansible/roles/gitea_runner/tasks/register.yml
+++ b/ansible/roles/gitea_runner/tasks/register.yml
@@ -44,13 +44,16 @@
     ('already exists' not in gitea_runner_register_output.stdout | default(''))
   timeout: 60
 
-- name: Ensure runner service is running after registration
-  ansible.builtin.command: systemctl --user start gitea-runner
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+# Note: service start is handled by service.yml (included after register.yml
+# in install_runner.yml). Starting here fails because the systemd unit file
+# has not been created yet.
+
+- name: Restart runner service after (re-)registration
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user restart gitea-runner
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists
diff --git a/ansible/roles/gitea_runner/tasks/rootless_docker.yml b/ansible/roles/gitea_runner/tasks/rootless_docker.yml
index 8f087dc..760d7e7 100644
--- a/ansible/roles/gitea_runner/tasks/rootless_docker.yml
+++ b/ansible/roles/gitea_runner/tasks/rootless_docker.yml
@@ -212,22 +212,20 @@
     - not gitea_runner_rootless_docker_check.stat.exists
 
 - name: Start rootless Docker daemon (systemd user service)
-  ansible.builtin.command: systemctl --user start docker
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user start docker
   changed_when: true
   when: gitea_runner_docker_rootless_setup
 
 - name: Enable rootless Docker daemon (systemd user service)
-  ansible.builtin.command: systemctl --user enable docker
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user enable docker
   changed_when: true
   when: gitea_runner_docker_rootless_setup
 
@@ -257,12 +255,11 @@
   when: gitea_runner_docker_rootless_setup
 
 - name: Reload systemd user daemon if network config changed
-  ansible.builtin.command: systemctl --user daemon-reload
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user daemon-reload
   changed_when: true
   when:
     - gitea_runner_docker_rootless_setup
@@ -300,12 +297,11 @@
   when: gitea_runner_docker_rootless_setup
 
 - name: Restart rootless Docker if config changed
-  ansible.builtin.command: systemctl --user restart docker
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user restart docker
   changed_when: true
   when:
     - gitea_runner_docker_rootless_setup
diff --git a/ansible/roles/gitea_runner/tasks/service.yml b/ansible/roles/gitea_runner/tasks/service.yml
index bc18c8a..b47ed62 100644
--- a/ansible/roles/gitea_runner/tasks/service.yml
+++ b/ansible/roles/gitea_runner/tasks/service.yml
@@ -9,12 +9,11 @@
   register: gitea_runner_service_file
 
 - name: Reload systemd user daemon
-  ansible.builtin.command: systemctl --user daemon-reload
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user daemon-reload
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists
@@ -22,12 +21,11 @@
     - gitea_runner_service_file is changed
 
 - name: Restart gitea-runner if service file changed
-  ansible.builtin.command: systemctl --user restart gitea-runner
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user restart gitea-runner
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists
@@ -35,12 +33,11 @@
     - gitea_runner_service_file is changed
 
 - name: Enable and start gitea-runner user service
-  ansible.builtin.command: systemctl --user enable --now gitea-runner
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user enable --now gitea-runner
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists