diff --git a/modules/server/forgejo-runner.nix b/modules/server/forgejo-runner.nix
index 03fe7bf..e5fa599 100644
--- a/modules/server/forgejo-runner.nix
+++ b/modules/server/forgejo-runner.nix
@@ -13,6 +13,8 @@
         };
       };
 
+      users.groups.secrets-access.members = [ "gitea-runner" ];
+
       services.gitea-actions-runner = {
         package = pkgs.forgejo-runner;
         instances = {