diff --git a/.gitea/workflows/registry-build-deploy.yml b/.gitea/workflows/registry-build-deploy.yml
index 1f5fd2e..140374e 100644
--- a/.gitea/workflows/registry-build-deploy.yml
+++ b/.gitea/workflows/registry-build-deploy.yml
@@ -34,7 +34,7 @@ defaults:
 
 jobs:
   build-and-push:
-    runs-on: self-hosted
+    runs-on: windows
     outputs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
@@ -110,7 +110,7 @@ jobs:
 
   deploy:
     needs: build-and-push
-    runs-on: self-hosted
+    runs-on: windows
     steps:
       - name: Checkout (shallow clone from this Gitea — no gitea.com)
         run: |
diff --git a/infrastructure/STAGING-DEPLOY.md b/infrastructure/STAGING-DEPLOY.md
index c100080..bbbefd3 100644
--- a/infrastructure/STAGING-DEPLOY.md
+++ b/infrastructure/STAGING-DEPLOY.md
@@ -74,7 +74,7 @@ cd C:\gitea-runner
   --instance "http://127.0.0.1:3000" `
   --token "<registration-token-from-gitea>" `
   --name "windows-staging" `
-  --labels "self-hosted,windows"
+  --labels "windows:host"
 ```
 
 Start (leave running, or install as a Windows service later):
@@ -208,6 +208,7 @@ On the Windows host, from repo `infrastructure/`:
 
 | Symptom | Fix |
 |---------|-----|
+| `no matching online runner with label` | Start `act_runner.exe daemon`; confirm runner is **Online** in Gitea. `runs-on` must match a runner label exactly — workflow uses `windows` (register with `windows:host`). |
 | Runner can't register on public IP | Use `http://127.0.0.1:3000` for `--instance` |
 | Variable name rejected in Gitea | No `GITEA_*` / `GITHUB_*` prefixes; use `CLONE_HOST` |
 | `server gave HTTP response to HTTPS client` | Add registry to Docker **insecure-registries**, restart Docker |