diff --git a/platform/dynamic-runner/README.md b/platform/dynamic-runner/README.md
index 89025b5..e61c76b 100644
--- a/platform/dynamic-runner/README.md
+++ b/platform/dynamic-runner/README.md
@@ -9,6 +9,10 @@ Gitea -> controller -> NATS -> pod worker -> homelab Kubernetes Pod
                            `-> VM worker  -> OpenSandbox -> Kata/microVM
 ```
 
+`dynamic-runner-pod-worker` 使用 durable `pod`，最多并发创建 4 个一次性 privileged
+Pod。任务 Pod、ServiceAccount、SPIFFE CSI socket 和生命周期都位于 homelab 的
+`dynamic-runner` namespace，不依赖 sandbox 集群或 OpenSandbox API。
+
 `10.60.0.13:8080` 是 VyOS 上的内网 HAProxy frontend，后端是 sandbox 节点的
 `30080` NodePort。它只依赖现有跨网段路由，不暴露公网，也不经过 Cloudflare
 Tunnel。controller 自身的 `192.168.10.127:8787` 仅供 Gitea webhook 和 sandbox
diff --git a/platform/dynamic-runner/kustomization.yaml b/platform/dynamic-runner/kustomization.yaml
index 00d940d..6bf792e 100644
--- a/platform/dynamic-runner/kustomization.yaml
+++ b/platform/dynamic-runner/kustomization.yaml
@@ -6,4 +6,5 @@ resources:
   - rbac.yaml
   - clusterspiffeid.yaml
   - deployment.yaml
+  - pod-worker-deployment.yaml
   - service.yaml
diff --git a/platform/dynamic-runner/pod-worker-deployment.yaml b/platform/dynamic-runner/pod-worker-deployment.yaml
index b3c6d9f..1b012e1 100644
--- a/platform/dynamic-runner/pod-worker-deployment.yaml
+++ b/platform/dynamic-runner/pod-worker-deployment.yaml
@@ -39,8 +39,8 @@ spec:
               mountPath: /trust
       containers:
         - name: pod-worker
-          image: gitea-dynamic-runner-controller:0.3.0-bootstrap
-          imagePullPolicy: Never
+          image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-controller@sha256:9f23e84934643bbe859dc0f8da418421dc8ab7b0958fdf1fdc91d562c30e246f
+          imagePullPolicy: IfNotPresent
           command: [/venv/bin/gitea-dynamic-runner-pod-worker]
           env:
             - name: NATS_URL