diff --git a/ansible/roles/gitea-runner/defaults/main.yml b/ansible/roles/gitea-runner/defaults/main.yml
index 58e75bb..9b35ef6 100644
--- a/ansible/roles/gitea-runner/defaults/main.yml
+++ b/ansible/roles/gitea-runner/defaults/main.yml
@@ -24,6 +24,11 @@ gitea_runner_prune_label: "gitea-runner=true"
 # Service configuration
 gitea_runner_service_restart_sec: "5"
 
+# Admin token for runner deregistration via Gitea API.
+# If not set, falls back to registration_token (which likely lacks admin scope).
+# Set this to a token with admin scope to enable automatic runner cleanup on removal.
+gitea_admin_token: ""
+
 # Removal defaults
 remove_systemd_template: true
 remove_runner_user: true
diff --git a/ansible/roles/gitea-runner/molecule/template-content/verify.yml b/ansible/roles/gitea-runner/molecule/template-content/verify.yml
index 3280642..5b9f450 100644
--- a/ansible/roles/gitea-runner/molecule/template-content/verify.yml
+++ b/ansible/roles/gitea-runner/molecule/template-content/verify.yml
@@ -30,7 +30,10 @@
         that:
           - "'Type=simple' in service_template.content | b64decode"
           - "'ExecStart={{ gitea_runner_binary_path }}' in service_template.content | b64decode"
-          - "'Restart=on-failure' in service_template.content | b64decode"
+          - "'Restart=always' in service_template.content | b64decode"
+          - "'Requires=docker.service' in service_template.content | b64decode"
+          - "'PartOf=docker.service' in service_template.content | b64decode"
+          - "'StartLimitBurst=10' in service_template.content | b64decode"
           - "'DOCKER_HOST=unix:///run/user' in service_template.content | b64decode"
           - "'XDG_RUNTIME_DIR=/run/user' in service_template.content | b64decode"
         fail_msg: "User service template is missing expected directives"
diff --git a/ansible/roles/gitea-runner/tasks/deregister.yml b/ansible/roles/gitea-runner/tasks/deregister.yml
index 51de648..35fc3ac 100644
--- a/ansible/roles/gitea-runner/tasks/deregister.yml
+++ b/ansible/roles/gitea-runner/tasks/deregister.yml
@@ -18,13 +18,11 @@
       else {} }}
   when: runner_file_stat.stat.exists | default(false) | bool
 
-- name: Deregister runner with Gitea via CLI
+- name: Deregister runner from Gitea via API
   ansible.builtin.command: >
-    {{ gitea_runner_binary_path }} delete
-    --token {{ registration_token }}
-    --name {{ runner_name }}
-    --instance {{ gitea_url }}
-    --no-interactive
+    curl -sf --connect-timeout 5 --max-time 10 -X DELETE
+    -H "Authorization: token {{ gitea_admin_token | default(registration_token) }}"
+    "{{ gitea_url }}/api/v1/admin/actions/runners/{{ runner_reg.id }}"
   args:
     chdir: "{{ gitea_runner_data_dir }}"
   become: true
@@ -35,10 +33,24 @@
   when:
     - runner_file_stat.stat.exists | default(false) | bool
     - not skip_runner_registration
+    - runner_reg.id is defined
   register: deregister_output
   changed_when: deregister_output.rc == 0
   failed_when: false
 
+- name: Warn if deregistration failed
+  ansible.builtin.debug:
+    msg: >-
+      WARNING: Runner deregistration from Gitea failed (rc={{ deregister_output.rc | default('N/A') }}).
+      The runner entry may remain in Gitea's admin UI as offline.
+      Use an admin token (gitea_admin_token var) to enable automatic cleanup,
+      or remove it manually from {{ gitea_url }}/-/admin/actions/runners
+  when:
+    - runner_file_stat.stat.exists | default(false) | bool
+    - not skip_runner_registration
+    - deregister_output is defined
+    - deregister_output.rc | default(1) != 0
+
 - name: Remove runner registration file
   ansible.builtin.file:
     path: "{{ gitea_runner_data_dir }}/.runner"
diff --git a/ansible/roles/gitea-runner/templates/docker-prune.service.j2 b/ansible/roles/gitea-runner/templates/docker-prune.service.j2
index 2418563..d0ad2b4 100644
--- a/ansible/roles/gitea-runner/templates/docker-prune.service.j2
+++ b/ansible/roles/gitea-runner/templates/docker-prune.service.j2
@@ -6,4 +6,4 @@ Type=oneshot
 Environment=DOCKER_HOST=unix:///run/user/{{ gitea_runner_uid }}/docker.sock
 Environment=XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
 ExecStart=/usr/bin/docker system prune -f --filter "label={{ gitea_runner_prune_label }}" --filter "until={{ gitea_runner_prune_until }}"
-ExecStart=/usr/bin/docker volume prune -f --filter "label={{ gitea_runner_prune_label }}" --filter "until={{ gitea_runner_prune_until }}"
+ExecStart=/usr/bin/docker volume prune -f --filter "label={{ gitea_runner_prune_label }}"
diff --git a/ansible/roles/gitea-runner/templates/gitea-runner-user.service.j2 b/ansible/roles/gitea-runner/templates/gitea-runner-user.service.j2
index 08830de..b130809 100644
--- a/ansible/roles/gitea-runner/templates/gitea-runner-user.service.j2
+++ b/ansible/roles/gitea-runner/templates/gitea-runner-user.service.j2
@@ -1,6 +1,8 @@
 [Unit]
 Description=Gitea Actions Runner (rootless)
 After=docker.service
+Requires=docker.service
+PartOf=docker.service
 
 [Service]
 Type=simple
@@ -10,8 +12,10 @@ Environment=DOCKER_HOST=unix:///run/user/{{ gitea_runner_uid }}/docker.sock
 Environment=XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
 ExecStop=/bin/kill -TERM $MAINPID
 TimeoutStopSec=30
-Restart=on-failure
+Restart=always
 RestartSec={{ gitea_runner_service_restart_sec }}
+StartLimitIntervalSec=300
+StartLimitBurst=10
 
 [Install]
 WantedBy=default.target