diff --git a/deploy/runner/README.md b/deploy/runner/README.md
index 8ed05df..e94233b 100644
--- a/deploy/runner/README.md
+++ b/deploy/runner/README.md
@@ -18,6 +18,10 @@ the `spencerm` user through the Docker socket. No sudo is needed.
   "bind source path does not exist". The runner removes what the job started when the job ends; the
   workflow also runs `down -v` itself.
 - Capacity 2: server and frontend run at the same time; e2e waits for both.
+- The actions cache (`setup-python` pip cache, `setup-node` npm cache) is served by the runner on
+  docker-1's docker0 address, port 8088, published in compose.yaml. Job containers cannot reach the
+  runner's own network; before this was set, every cache restore and save timed out after about
+  four and a half minutes, which made the server job take 13 minutes instead of 4.
 
 ## Install (once)
 
diff --git a/deploy/runner/compose.yaml b/deploy/runner/compose.yaml
index b0352ca..e05f785 100644
--- a/deploy/runner/compose.yaml
+++ b/deploy/runner/compose.yaml
@@ -26,6 +26,10 @@ services:
       # unregistered start and are left here so the names are known; no token is set in this file.
       GITEA_INSTANCE_URL: https://gt.pescoinc.biz
       GITEA_RUNNER_NAME: docker-1
+    ports:
+      # The actions cache server, for the job containers only (docker0 address, not the LAN).
+      # Must match cache.host and cache.port in data/config.yaml.
+      - "172.17.0.1:8088:8088"
     volumes:
       - ./data:/data                                   # .runner (the registration), config.yaml, cache, job logs
       # Job workspaces. The host path and the container path must be the same (see data/config.yaml).
diff --git a/deploy/runner/config.yaml b/deploy/runner/config.yaml
index 9ff8cad..93d574c 100644
--- a/deploy/runner/config.yaml
+++ b/deploy/runner/config.yaml
@@ -17,6 +17,12 @@ runner:
 cache:
   enabled: true
   dir: /data/cache
+  # The cache server runs inside the runner container. Job containers sit on their own per-job
+  # networks and cannot reach the runner's own network, so the server is published on docker-1's
+  # docker0 address (reachable from every container on the host, not from the LAN) at a fixed port.
+  # Without this every cache restore and save times out after minutes (seen on the first run).
+  host: 172.17.0.1
+  port: 8088
 
 container:
   # The job workspace is a host directory under workdir_parent, mounted into the job container at that
@@ -25,6 +31,9 @@ container:
   bind_workdir: true
   workdir_parent: home/spencerm/gitea/runner/work   # no leading slash; the runner adds it
   privileged: false
-  valid_volumes: []
+  # The workspace bind above is itself a volume the runner must allow, or it is silently ignored
+  # ("is not a valid volume, will be ignored") and the job falls back to a Docker volume.
+  valid_volumes:
+    - /home/spencerm/gitea/runner/work/**
   # The proxy removes what a job started (the CI compose stack included) when the job ends.
   sweep: true