diff --git a/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-vm.yaml.j2 b/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-vm.yaml.j2
index c7a769306b..f6bc40bfdf 100644
--- a/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-vm.yaml.j2
+++ b/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-vm.yaml.j2
@@ -72,6 +72,20 @@ spec:
               - {{ pkg }}
 {% endfor %}
 {% endif %}
+{% set _vm_user = (env == 'production') | ternary(forgejo_runnerhostvm_user, forgejo_stg_runnerhostvm_user) %}
+            write_files:
+              - path: /home/{{ _vm_user }}/.config/systemd/user/podman.socket.d/chown.conf
+                owner: "{{ _vm_user }}:{{ _vm_user }}"
+                content: |
+                  [Socket]
+                  ExecStartPost=/usr/bin/podman unshare chown 0:1000 %t/podman/podman.sock
+            runcmd:
+              - "loginctl enable-linger {{ _vm_user }}"
+              - >-
+                sudo -u {{ _vm_user }} bash -c
+                'export XDG_RUNTIME_DIR=/run/user/$(id -u)
+                && systemctl --user daemon-reload
+                && systemctl --user enable --now podman.socket'
         name: cloudinitdisk
       - name: sa-token-disk
         secret: