diff --git a/.forgejo/workflows/dimensionlab-website.yml b/.forgejo/workflows/dimensionlab-website.yml
index 8cac0a1..672ab25 100644
--- a/.forgejo/workflows/dimensionlab-website.yml
+++ b/.forgejo/workflows/dimensionlab-website.yml
@@ -49,6 +49,9 @@ jobs:
     needs: ci
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: docker
+    container:
+      image: ghcr.io/catthehacker/ubuntu:act-latest
+      options: --security-opt label=disable
     timeout-minutes: 30
     steps:
       - name: Checkout
diff --git a/apps/web/src/lib/workspace-boundary.test.ts b/apps/web/src/lib/workspace-boundary.test.ts
index 50dcac6..49f4cee 100644
--- a/apps/web/src/lib/workspace-boundary.test.ts
+++ b/apps/web/src/lib/workspace-boundary.test.ts
@@ -275,6 +275,7 @@ describe("workspace boundaries", () => {
     expect(workflow).toContain("bun run test");
     expect(workflow).toContain("bun run build");
     expect(workflow).toContain("needs: ci");
+    expect(workflow).toContain("options: --security-opt label=disable");
     expect(workflow).toContain("github.event_name == 'push'");
     expect(workflow).toContain("github.ref == 'refs/heads/main'");
     expect(workflow).toContain("docker inspect dimensionlab-website");