diff --git a/.forgejo/workflows/deploy.yaml b/.forgejo/workflows/deploy.yaml
index 6d5aa3a..cdf50e5 100644
--- a/.forgejo/workflows/deploy.yaml
+++ b/.forgejo/workflows/deploy.yaml
@@ -13,15 +13,19 @@ concurrency:
 
 jobs:
   build-deploy:
-    # `flatpak` is a privileged runner registered to this repository alone
-    # (/etc/forgejo-runner/config-catcrafts.yaml on the box, label
-    # flatpak:docker://archlinux:latest): crafter-build is the Crafter.Build
-    # Flatpak, and bubblewrap inside the job container needs the privilege.
-    # The same runner carries the two deploy bind mounts (/deploy, /deploy-app)
-    # and a docker volume at /var/lib/flatpak that keeps the installed Flatpak
-    # and its Sdk between runs. Same route as imsd's package job; see
-    # deploy/README.md "Runner configuration".
-    runs-on: flatpak
+    # `catcrafts-deploy` is a privileged runner registered to this repository
+    # alone (/etc/forgejo-runner/config-catcrafts.yaml on the box, label
+    # catcrafts-deploy:docker://archlinux:latest): crafter-build is the
+    # Crafter.Build Flatpak, and bubblewrap inside the job container needs the
+    # privilege. The same runner carries the two deploy bind mounts (/deploy,
+    # /deploy-app) and a docker volume at /var/lib/flatpak that keeps the
+    # installed Flatpak and its Sdk between runs. Same route as imsd's package
+    # job, but under a label of its own: imsd's `flatpak` label is also on
+    # the organisation-wide runner (cx33-org-flatpak, since 2026-10-14), which
+    # has no mounts and defaults to alpine, and a job goes to whichever runner
+    # with the label polls first. Crafter.Build's run 550 (2026-10-16) failed
+    # that way. See deploy/README.md "Runner configuration".
+    runs-on: catcrafts-deploy
     env:
       # Which crafter-build. `stable` is the branch Crafter.Build publishes
       # from its release tags, `beta` follows every push to its master (the
diff --git a/deploy/README.md b/deploy/README.md
index 5546467..3c87362 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -83,14 +83,20 @@ systemctl reload caddy
 ## Runner configuration
 
 The deploy job runs on a privileged runner registered to this repository alone
-(`runs-on: flatpak`), not on the shared `arch-latest` runner. crafter-build is
-the Crafter.Build Flatpak, and bubblewrap inside the job container needs the
-privilege; imsd's package job is set up the same way. On the box since
-2026-10-12:
+(`runs-on: catcrafts-deploy`), not on the shared `arch-latest` runner.
+crafter-build is the Crafter.Build Flatpak, and bubblewrap inside the job
+container needs the privilege; imsd's package job is set up the same way. The
+label is this repository's own on purpose: a job goes to whichever runner
+carrying its label polls first, and imsd's `flatpak` label is also on the
+organisation-wide `cx33-org-flatpak` runner (since 2026-10-14), which has no
+mounts and defaults to an alpine image. Crafter.Build's run 550 (2026-10-16)
+landed there and failed before building. On the box since 2026-10-12:
 
 * `/etc/forgejo-runner/config-catcrafts.yaml`: label
-  `flatpak:docker://archlinux:latest`, `privileged: true`, cache proxy on port
-  34570.
+  `catcrafts-deploy:docker://archlinux:latest` (was `flatpak` until
+  2026-10-17), `privileged: true`, cache proxy on port 34570. Labels live in
+  this file; the runner declares them at start, so a label change is an edit
+  plus a service restart, never a re-registration.
 * `forgejo-runner-catcrafts.service`, a copy of the imsd unit, working
   directory `/var/lib/forgejo-runner-catcrafts`. Its `.runner` is the
   registration: scope `Catcrafts/catcrafts.net`, name