diff --git a/runner-config.yml b/runner-config.yml
index 9a7ef2f..51e913f 100644
--- a/runner-config.yml
+++ b/runner-config.yml
@@ -17,7 +17,10 @@ container:
   privileged: false
   valid_volumes:
     - '**'
-  # Auto-detect and mount the host docker socket into job containers so steps
-  # like "Update deploy.json" can `docker exec xetup-web`. ("-" disabled it.)
-  docker_host: ""
+  # Explicitly bind-mount the host docker socket into job containers so steps
+  # like "Update deploy.json" can `docker exec xetup-web`. docker_host auto-mount
+  # ("") did not work on runner 6.3.1, so we mount the socket via options and
+  # let the job's default DOCKER_HOST (unix:///var/run/docker.sock) pick it up.
+  docker_host: "-"
+  options: "-v /var/run/docker.sock:/var/run/docker.sock"
   force_pull: false