diff --git a/.gitignore b/.gitignore
index 1688b7a..615a741 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,6 @@
 # Forgejo runner registration file — contains a secret, never commit.
+# Bare `.runner` (no slash) matches it in any directory, incl. the repo root.
+.runner
 runner/.runner
 *.env
 
diff --git a/README.md b/README.md
index 86a3408..3e09098 100644
--- a/README.md
+++ b/README.md
@@ -132,22 +132,30 @@ On the **home desktop** (already has Docker + is in the `docker` group). Put the
 binary in place, register in a home-dir working folder (snap Docker needs the
 build context under `$HOME`), then install the systemd unit so it survives
 reboots and auto-claims jobs:
+Run these from the cloned `jb-infra` repo:
 ```sh
-sudo install -m 0755 forgejo-runner /usr/local/bin/forgejo-runner
+# 1. Binary — skip if already present (check: command -v forgejo-runner).
+#    The unit's ExecStart points at /usr/local/sbin/forgejo-runner.
+sudo install -m 0755 forgejo-runner /usr/local/sbin/forgejo-runner
+
+# 2. Working dir + config (under $HOME so snap Docker can read build contexts).
 mkdir -p ~/forgejo-runner && cp runner/config.yml ~/forgejo-runner/
-cd ~/forgejo-runner
 
-# Registration token: Forgejo → Site Admin → Actions → Runners → Create
-forgejo-runner register --no-interactive \
-  --instance https://git.joshbairstow.com \
-  --token <REGISTRATION_TOKEN> \
-  --name desktop --labels desktop:host        # ':host' => run jobs on the host, use host Docker
+# 3. Register IN the working dir so .runner lands there (token: Forgejo →
+#    Site Admin → Actions → Runners → Create). The subshell keeps cwd in the repo.
+( cd ~/forgejo-runner && forgejo-runner register --no-interactive \
+    --instance https://git.joshbairstow.com \
+    --token <REGISTRATION_TOKEN> \
+    --name desktop --labels desktop:host )     # ':host' => run on host, use host Docker
 
+# 4. Install + enable the always-on service.
 sudo cp runner/forgejo-runner.service /etc/systemd/system/
 sudo systemctl daemon-reload
 sudo systemctl enable --now forgejo-runner
-systemctl status forgejo-runner               # expect active (running); runner shows green in Forgejo
+systemctl status forgejo-runner                # expect active (running); runner shows green in Forgejo
 ```
+Already registered in the wrong directory? Don't re-register — just
+`mv .runner ~/forgejo-runner/` (it's location-independent credentials).
 The `:host` label is what lets the `docker build` step work (the job runs on the
 host using its Docker, not in a socket-less container). See
 [`runner/config.yml`](runner/config.yml) and
diff --git a/runner/forgejo-runner.service b/runner/forgejo-runner.service
index 92bc95c..341ed21 100644
--- a/runner/forgejo-runner.service
+++ b/runner/forgejo-runner.service
@@ -5,7 +5,7 @@
 # in the `docker` group) so host-execution jobs can run `docker build`.
 #
 # Install:
-#   sudo install -m 0755 forgejo-runner /usr/local/bin/forgejo-runner   # the binary
+#   sudo install -m 0755 forgejo-runner /usr/local/sbin/forgejo-runner   # the binary
 #   mkdir -p ~/forgejo-runner && cp config.yml ~/forgejo-runner/
 #   cd ~/forgejo-runner
 #   forgejo-runner register --no-interactive \
@@ -39,7 +39,7 @@ SupplementaryGroups=docker
 WorkingDirectory=/home/joshbairstow/forgejo-runner
 Environment=HOME=/home/joshbairstow
 Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
-ExecStart=/usr/local/bin/forgejo-runner daemon --config /home/joshbairstow/forgejo-runner/config.yml
+ExecStart=/usr/local/sbin/forgejo-runner daemon --config /home/joshbairstow/forgejo-runner/config.yml
 Restart=on-failure
 RestartSec=5