diff --git a/modules/gitlab-runner.nix b/modules/gitlab-runner.nix
new file mode 100644
index 0000000..fe6e947
--- /dev/null
+++ b/modules/gitlab-runner.nix
@@ -0,0 +1,77 @@
+{ config, lib, pkgs, ... }:
+{
+  sops.secrets = {
+    runnerRegistrationConfig = {
+      owner = config.users.users.gitlab-runner.name;
+      key = "gitlab/runner_registration_config";
+    };
+  };
+
+  users.groups.gitlab-runner = { };
+  users.users.gitlab-runner = {
+    isSystemUser = true;
+    group = config.users.groups.gitlab-runner.name;
+  };
+
+  containers.gitlab-runner = {
+    autoStart = true;
+
+    privateNetwork = true;
+    hostAddress = "192.168.100.1";
+    localAddress = "192.168.100.2";
+
+    bindMounts = {
+      "${config.sops.secrets.runnerRegistrationConfig.path}" = {
+        hostPath = config.sops.secrets.runnerRegistrationConfig.path;
+      };
+    };
+
+    config =
+      let
+        hostConfig = config;
+      in
+      args@{ config, ... }: {
+
+        nix = {
+          package = pkgs.nixUnstable;
+          extraOptions = ''
+            experimental-features = nix-command flakes
+          '';
+        };
+
+        environment.systemPackages = with pkgs; [
+          git
+          htop
+          nload
+        ];
+
+        users.groups.gitlab-runner = { };
+        users.users.gitlab-runner = {
+          isSystemUser = true;
+          group = config.users.groups.gitlab-runner.name;
+        };
+
+        services = {
+          openssh.enable = true;
+          gitlab-runner = {
+            enable = true;
+            services = {
+              shell = {
+                registrationConfigFile = hostConfig.sops.secrets.runnerRegistrationConfig.path;
+                executor = "shell";
+                tagList = [ "nix" ];
+              };
+            };
+          };
+        };
+
+        systemd.services.gitlab-runner.serviceConfig = {
+          DynamicUser = lib.mkForce false;
+          User = config.users.users.gitlab-runner.name;
+          Group = config.users.groups.gitlab-runner.name;
+        };
+
+        system.stateVersion = "22.05";
+      };
+  };
+}
diff --git a/profiles/storage.nix b/profiles/storage.nix
index e69bc4f..bf67d9a 100644
--- a/profiles/storage.nix
+++ b/profiles/storage.nix
@@ -13,6 +13,7 @@
     ../modules/custom-backup-job.nix
     ../modules/custom-monit.nix
     ../modules/jitsi.nix
+    ../modules/gitlab-runner.nix
   ];
 
   sops.secrets = {
diff --git a/secrets.enc.yml b/secrets.enc.yml
index 48740aa..7f7e38b 100644
--- a/secrets.enc.yml
+++ b/secrets.enc.yml
@@ -1,3 +1,5 @@
+gitlab:
+    runner_registration_config: ENC[AES256_GCM,data:BxkP4+moNV4eip9g2MoOFzZgWvYHELQ3qOJxMAGV9Ffdy5Fhl7mFNE85yv2I09hg2hwd68V3ThwiZ7eBoOi87bDRN82PeIyDqPtjbNA1ZcLJqE8=,iv:I/1wzcVSiz90cgRqMhGfN1wdB0EVQYVPyFn3RvSbTaw=,tag:8hMKQfmtPZf3nbs4LjnH3w==,type:str]
 synapse:
     db_password: ENC[AES256_GCM,data:hy2BgTsRaZDQZULTW/csmnRy5ZjDEuPqxyuINv0ov5pFzDkozJVL1wut3HgBXjYZ8bqNjS5pCPQtkznw,iv:i41zKGwvPGIEZP0ZjhRaY4UMeOXBovQmLr1e1ewZhV4=,tag:3kKKYouH+lOrNxPJE5ul/Q==,type:str]
     macaroon_secret_key: ENC[AES256_GCM,data:6n1gCit2MC8l4VR9DSUR87BB+hY5Oza33423sbV8sNIXmZsPzhyvxaBalK/0TVjLH6Q=,iv:OgHxNG96ZW4+LPZhLAtOD01Wibad6vSX6s4BrPE67YE=,tag:OGIz/ufUwt8/pUMLvoaXtg==,type:str]
@@ -47,8 +49,8 @@ sops:
     azure_kv: []
     hc_vault: []
     age: []
-    lastmodified: "2021-12-27T05:31:16Z"
-    mac: ENC[AES256_GCM,data:cvOznEdfRPo/jl1kYMqWlb9LJ7FqjZ6MwIOgB/1CbSI3DWytX+JsMouFCIR8yatqYpFhZCQmtIKhsvwAoufiWwTYO3Ou329x2NbUIPq1C7BLJaJQJanDygbgNvbxM4ZZL78PUMVAsJnj0sxhcnBPeZUJPss3VtQ/HnRKOPe0Oq4=,iv:TzikJsF211SOiL7mm7yHtXux8kdYAhJk9bybGGmBTpo=,tag:8RwlTxh+2mEEPmKDtelu7A==,type:str]
+    lastmodified: "2022-07-19T06:19:36Z"
+    mac: ENC[AES256_GCM,data:3Tu/z60AujniKkVHyQrB26tWRGRg8JxrzEMbCKD67c6snRfkmz6azjWjA8pwCQ2zx4hWqGYywJa9ngIWUqlrdu/4x6RwXTBLwYr7YwqfuuLnLm+c2Kb7Vo4nNu1nnk23BNS7GxYSvP+kjJrshPVwfFcz9SOqNSHFNL3VXVeKS9E=,iv:yA6yz9MKccfFcgwiQ6tdyr7PZH/d/qCGPbIXtnKHmtA=,tag:q99hXi7BeY0troFaOc4YLA==,type:str]
     pgp:
         - created_at: "2021-11-29T00:57:34Z"
           enc: |
@@ -111,4 +113,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: 7675e1c632a9a0644c6ab828dbcc48a5300773a8
     unencrypted_suffix: _unencrypted
-    version: 3.7.1
+    version: 3.7.3