diff --git a/lib/modules/nixos/podman.nix b/lib/modules/nixos/podman.nix
index 2c82844..3780867 100644
--- a/lib/modules/nixos/podman.nix
+++ b/lib/modules/nixos/podman.nix
@@ -5,22 +5,24 @@
   ...
 }:
 {
-  config = lib.mkIf (config.virtualisation.oci-containers.backend == "podman") {
+  config = lib.mkIf config.virtualisation.podman.enable {
     environment = {
       systemPackages = with pkgs; [
+        podman-tui
         podman-compose
       ];
     };
 
     virtualisation = {
       podman = {
+        # enable = true;
         dockerCompat = true;
         dockerSocket.enable = true;
         defaultNetwork.settings.dns_enabled = true;
       };
 
       oci-containers = {
-        # backend = "podman";
+        backend = "podman";
       };
     };
 
diff --git a/packages/default.nix b/packages/default.nix
index 4ed3cd6..8ec7afe 100644
--- a/packages/default.nix
+++ b/packages/default.nix
@@ -3,14 +3,10 @@ let
   iosevkaLyteTerm = pkgs.callPackage ./iosevkaLyteTerm.nix { };
 in
 {
-  iosevka = pkgs.callPackage ./iosevka.nix { };
-
   inherit iosevkaLyteTerm;
-
-  iosevkaLyteTermSubset = pkgs.callPackage ./iosevkaLyteTermSubset.nix {
-    inherit iosevkaLyteTerm;
-  };
-
+  iosevka = pkgs.callPackage ./iosevka.nix { };
+  iosevkaLyteTermSubset = pkgs.callPackage ./iosevkaLyteTermSubset.nix { };
   installer = pkgs.callPackage ./installer.nix { };
   ghostty-terminfo = pkgs.callPackage ./ghostty-terminfo.nix { };
+  forgejo-actions-container = pkgs.callPackage ./forgejo-actions-container.nix { };
 }
diff --git a/packages/forgejo-actions-container.nix b/packages/forgejo-actions-container.nix
new file mode 100644
index 0000000..d23254b
--- /dev/null
+++ b/packages/forgejo-actions-container.nix
@@ -0,0 +1,23 @@
+{
+  nodejs_23,
+  nix,
+  dockerTools,
+}:
+let
+  pname = "forgejo-actions-container";
+in
+# bootstrap this into the forgejo server with
+# $ podman login ${FORGEJO_ENDPOINT:-git.lyte.dev}
+# $ podman image load -i (nix build .#forgejo-actions-container --print-out-paths)
+# $ podman image push git.lyte.dev/lytedev/nix:forgejo-actions-container-$NIX_VERSION
+dockerTools.buildLayeredImage {
+  name = "git.lyte.dev/lytedev/nix";
+  tag = "${pname}-${nix.version}";
+  config = {
+    Cmd = [ "/bin/nix" ];
+  };
+  contents = [
+    nix
+    nodejs_23
+  ];
+}
diff --git a/packages/hosts/beefcake.nix b/packages/hosts/beefcake.nix
index a521931..8a0a5c1 100644
--- a/packages/hosts/beefcake.nix
+++ b/packages/hosts/beefcake.nix
@@ -108,7 +108,7 @@
     };
   };
 
-  virtualisation.oci-containers.backend = "podman";
+  virtualisation.podman.enable = true;
 
   services.deno-netlify-ddns-client = {
     enable = true;
@@ -1066,9 +1066,10 @@
             labels = [
               # type ":host" does not depend on docker/podman/lxc
               "podman"
-              "nix:docker://git.lyte.dev/lytedev/nix:latest"
-              "beefcake:host"
-              "nixos-host:host"
+              "nix-2.24.12:docker://git.lyte.dev/lytedev/nix:forgejo-actions-container-2.24.12"
+              "nix-latest:docker://git.lyte.dev/lytedev/nix:forgejo-actions-container-latest"
+              # "beefcake:host"
+              # "nixos-host:host"
             ];
             tokenFile = config.sops.secrets."forgejo-runner.env".path;
             hostPackages = with pkgs; [
diff --git a/packages/hosts/default.nix b/packages/hosts/default.nix
index 3d04c07..9ac663b 100644
--- a/packages/hosts/default.nix
+++ b/packages/hosts/default.nix
@@ -15,5 +15,6 @@ in
 
   generic-headless = stableHost ./generic-headless.nix { };
   generic = stableHost ./generic.nix { };
+
   # arm-dragon = host ./dragon.nix { system = "aarch64-linux"; };
 }
diff --git a/packages/hosts/dragon.nix b/packages/hosts/dragon.nix
index 2016866..a1f66a6 100644
--- a/packages/hosts/dragon.nix
+++ b/packages/hosts/dragon.nix
@@ -33,6 +33,7 @@
     common-gpu-amd
     common-pc-ssd
   ];
+
   hardware.bluetooth.enable = true;
   powerManagement.cpuFreqGovernor = "performance";
 
@@ -49,6 +50,7 @@
   services.postgresql.enable = true;
   programs.steam.enable = true;
   lyte.desktop.enable = true;
+  virtualisation.podman.enable = true;
 
   home-manager.users.daniel = {
     lyte = {