diff --git a/.gitea/workflows/scripts/install-tools.sh b/.gitea/workflows/scripts/install-tools.sh
index 3989c45..64c930e 100755
--- a/.gitea/workflows/scripts/install-tools.sh
+++ b/.gitea/workflows/scripts/install-tools.sh
@@ -24,7 +24,11 @@ install_check_jsonschema() { have check-jsonschema || { log "check-jsonschema ${
 install_kyverno() {
   have kyverno && return 0
   log "kyverno CLI ${KYVERNO_VERSION}"
-  local url="https://github.com/kyverno/kyverno/releases/download/v${KYVERNO_VERSION}/kyverno-cli_v${KYVERNO_VERSION}_${os}_${arch}.tar.gz"
+  # Arch strings differ per tool: the kyverno CLI tarball uses x86_64 (uname -m style),
+  # NOT amd64 — map it here (mirrors infra/devcontainer/Containerfile). chainsaw/kubectl
+  # below use the amd64/arm64 form, so only kyverno needs this.
+  local karch="$arch"; case "$arch" in amd64) karch=x86_64 ;; esac
+  local url="https://github.com/kyverno/kyverno/releases/download/v${KYVERNO_VERSION}/kyverno-cli_v${KYVERNO_VERSION}_${os}_${karch}.tar.gz"
   curl -fsSL "$url" | tar -xz -C "$bindir" kyverno
 }
 
diff --git a/apps/gitea-actions.yaml b/apps/gitea-actions.yaml
index b91c529..4447d82 100644
--- a/apps/gitea-actions.yaml
+++ b/apps/gitea-actions.yaml
@@ -103,6 +103,22 @@ spec:
         # ---- act_runner: registers with Gitea, dispatches jobs to the DinD daemon ----
         - name: runner
           image: gitea/act_runner:0.2.11
+          # Wait for the DinD sidecar to publish its TLS client certs into the shared
+          # emptyDir before starting the daemon — act_runner reads /certs/client/ca.pem at
+          # startup and hard-exits if it is missing (a startup race against the sidecar).
+          # Then exec the image's normal entrypoint (/sbin/tini -- /opt/act/run.sh), which
+          # registers-from-env on first boot and runs `act_runner daemon`.
+          command:
+            - /bin/sh
+            - -c
+            - |
+              i=0
+              until [ -f /certs/client/ca.pem ]; do
+                i=$((i + 1))
+                [ "$i" -ge 60 ] && { echo "dind certs never appeared" >&2; exit 1; }
+                echo "waiting for dind TLS certs ($i)"; sleep 1
+              done
+              exec /sbin/tini -- /opt/act/run.sh
           env:
             - name: GITEA_INSTANCE_URL
               value: https://gitea.home.keithjackson.dev