diff --git a/.gitea/workflows/pod-smoke.yml b/.gitea/workflows/pod-smoke.yml
index 1090663..1d7967d 100644
--- a/.gitea/workflows/pod-smoke.yml
+++ b/.gitea/workflows/pod-smoke.yml
@@ -16,4 +16,4 @@ jobs:
             -audience ci-smoke \
             -socketPath /run/spire/agent-sockets/spire-agent.sock \
             >/dev/null
-          test "$(id -u)" = 0
+          test "$(id -u)" = 2000
diff --git a/cmd/gitea-dynamic-runner/controller.go b/cmd/gitea-dynamic-runner/controller.go
index f7e9d01..61fcb07 100644
--- a/cmd/gitea-dynamic-runner/controller.go
+++ b/cmd/gitea-dynamic-runner/controller.go
@@ -93,6 +93,7 @@ func runController(ctx context.Context) error {
 	}
 	bootstrap := runnerbootstrap.Bootstrap{
 		Capabilities: capabilities, FacadeURL: config.FacadeURL, FacadeSPIFFEID: config.FacadeSPIFFEID,
+		WorkloadAPIAddr: config.WorkloadAPIAddr,
 	}
 
 	labels := []string{"self-hosted"}
diff --git a/internal/runnerbootstrap/bootstrap.go b/internal/runnerbootstrap/bootstrap.go
index 59c64f8..c4151ee 100644
--- a/internal/runnerbootstrap/bootstrap.go
+++ b/internal/runnerbootstrap/bootstrap.go
@@ -24,13 +24,14 @@ const (
 // Bootstrap emits assignment-scoped launch configuration. FacadeURL is the
 // controller endpoint reached by the local SPIFFE proxy, not by Runner itself.
 type Bootstrap struct {
-	Capabilities   runnerfacade.Capabilities
-	FacadeURL      string
-	FacadeSPIFFEID string
+	Capabilities    runnerfacade.Capabilities
+	FacadeURL       string
+	FacadeSPIFFEID  string
+	WorkloadAPIAddr string
 }
 
 func (b Bootstrap) Environment(assignment taskassignment.Assignment) (map[string]string, error) {
-	if assignment.ID == "" || assignment.Identity.SPIFFEID == "" || b.FacadeSPIFFEID == "" {
+	if assignment.ID == "" || assignment.Identity.SPIFFEID == "" || b.FacadeSPIFFEID == "" || b.WorkloadAPIAddr == "" {
 		return nil, errors.New("assignment ID and SPIFFE ID are required")
 	}
 	parsed, err := url.Parse(b.FacadeURL)
@@ -42,12 +43,13 @@ func (b Bootstrap) Environment(assignment taskassignment.Assignment) (map[string
 		return nil, errors.New("runner capability issuer is not configured")
 	}
 	return map[string]string{
-		EnvAssignmentID: assignment.ID,
-		EnvCapability:   capability,
-		EnvFacadeURL:    b.FacadeURL,
-		EnvFacadeID:     b.FacadeSPIFFEID,
-		EnvSPIFFEID:     assignment.Identity.SPIFFEID,
-		EnvBackend:      string(assignment.Backend),
+		EnvAssignmentID:          assignment.ID,
+		EnvCapability:            capability,
+		EnvFacadeURL:             b.FacadeURL,
+		EnvFacadeID:              b.FacadeSPIFFEID,
+		EnvSPIFFEID:              assignment.Identity.SPIFFEID,
+		EnvBackend:               string(assignment.Backend),
+		"SPIFFE_ENDPOINT_SOCKET": b.WorkloadAPIAddr,
 	}, nil
 }
 
diff --git a/internal/runnerbootstrap/bootstrap_test.go b/internal/runnerbootstrap/bootstrap_test.go
index e3f60c4..0ab3fbf 100644
--- a/internal/runnerbootstrap/bootstrap_test.go
+++ b/internal/runnerbootstrap/bootstrap_test.go
@@ -16,9 +16,10 @@ func testBootstrap(t *testing.T) Bootstrap {
 		t.Fatal(err)
 	}
 	return Bootstrap{
-		Capabilities:   capabilities,
-		FacadeURL:      "https://runner-facade.gitea-actions.svc:8443",
-		FacadeSPIFFEID: "spiffe://ddupan.top/ns/gitea-actions/sa/gitea-dynamic-runner",
+		Capabilities:    capabilities,
+		FacadeURL:       "https://runner-facade.gitea-actions.svc:8443",
+		FacadeSPIFFEID:  "spiffe://ddupan.top/ns/gitea-actions/sa/gitea-dynamic-runner",
+		WorkloadAPIAddr: "unix:///run/spire/agent-sockets/spire-agent.sock",
 	}
 }
 
@@ -48,6 +49,9 @@ func TestEnvironmentIsDeterministicAndAssignmentScoped(t *testing.T) {
 	if first[EnvBackend] != "pod" || first[EnvFacadeID] == "" {
 		t.Fatalf("environment = %#v", first)
 	}
+	if first["SPIFFE_ENDPOINT_SOCKET"] != "unix:///run/spire/agent-sockets/spire-agent.sock" {
+		t.Fatalf("environment = %#v", first)
+	}
 }
 
 func TestRegistrationMatchesOfficialRunnerSchema(t *testing.T) {