diff --git a/platform/dynamic-runner/README.md b/platform/dynamic-runner/README.md
index ab1501c..89025b5 100644
--- a/platform/dynamic-runner/README.md
+++ b/platform/dynamic-runner/README.md
@@ -1,12 +1,12 @@
 # Gitea dynamic runner controller
 
-controller 接收 Gitea `workflow_job` webhook，对带 `[self-hosted, pod]` 或
-`[self-hosted, vm]` 的 queued job 直接调用 OpenSandbox Lifecycle API。链路不使用
-NATS、消息队列或平台侧 webhook worker。
+controller 接收 Gitea `workflow_job` webhook，并将带 `[self-hosted, pod]` 或
+`[self-hosted, vm]` 的 queued job 持久化到 NATS JetStream。Pod workload 在 homelab
+集群由原生 Kubernetes worker 创建；只有 VM workload 通过 OpenSandbox Lifecycle API。
 
 ```text
-Gitea -> dynamic-runner-controller -> http://10.60.0.13:8080/v1/sandboxes
-                                      -> ci-pod / ci-vm Pool
+Gitea -> controller -> NATS -> pod worker -> homelab Kubernetes Pod
+                           `-> VM worker  -> OpenSandbox -> Kata/microVM
 ```
 
 `10.60.0.13:8080` 是 VyOS 上的内网 HAProxy frontend，后端是 sandbox 节点的
diff --git a/platform/dynamic-runner/deployment.yaml b/platform/dynamic-runner/deployment.yaml
index e99f278..f47a256 100644
--- a/platform/dynamic-runner/deployment.yaml
+++ b/platform/dynamic-runner/deployment.yaml
@@ -40,7 +40,7 @@ spec:
               mountPath: /trust
       containers:
         - name: controller
-          image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-controller@sha256:b65a39a8adcdb2b886f0fb956fc6e6bae822bfbc1ff8c48213948e4c0a7d551a
+          image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-controller@sha256:9f23e84934643bbe859dc0f8da418421dc8ab7b0958fdf1fdc91d562c30e246f
           imagePullPolicy: IfNotPresent
           env:
             - name: NATS_URL
@@ -52,7 +52,9 @@ spec:
             - name: NATS_WORKER_PASSWORD_FILE
               value: /run/dynamic-runner-secrets/nats-worker-password
             - name: POD_CONSUMER_ENABLED
-              value: "true"
+              value: "false"
+            - name: VM_CONSUMER_ENABLED
+              value: "false"
             - name: WEBHOOK_SECRET_FILE
               value: /run/dynamic-runner-secrets/webhook-secret
             - name: REGISTRATION_TOKEN_FILE