diff --git a/self-hosted-runner/Dockerfile b/self-hosted-runner/Dockerfile
index 51fe346..c6a9dc5 100644
--- a/self-hosted-runner/Dockerfile
+++ b/self-hosted-runner/Dockerfile
@@ -52,9 +52,6 @@ RUN usermod -aG sudo ubuntu \
 # Allow sudo without password
 RUN echo '%sudo ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
 
-COPY entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
-
 WORKDIR /home/ubuntu
 USER ubuntu
 
@@ -66,6 +63,8 @@ USER root
 
 RUN ./bin/installdependencies.sh
 
-USER ubuntu
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
 ENTRYPOINT ["/entrypoint.sh"]
 
diff --git a/self-hosted-runner/entrypoint.sh b/self-hosted-runner/entrypoint.sh
index 1a04ffe..f357170 100644
--- a/self-hosted-runner/entrypoint.sh
+++ b/self-hosted-runner/entrypoint.sh
@@ -1,11 +1,24 @@
 #!/bin/bash
 
+ARCH=$(uname -m)
+
+if [ "$ARCH" = "aarch64" ]; then
+    echo "Architecture is aarch64 (ARM64). Applying QEMU workarounds..."
+    mkdir -p /etc/docker
+    cat <<EOF > /etc/docker/daemon.json
+{
+  "iptables": false,
+  "ip6tables": false
+}
+EOF
+fi
+
 # Start docker daemon
-sudo service docker start
+service docker start
 
 if [ -n "$PERSONAL_ACCESS_TOKEN" ]; then
     echo "Using personal access token";
-    ./config.sh \
+    runuser -u ubuntu -- ./config.sh \
         --unattended \
         --url $REPOSITORY_URL \
         --pat "$PERSONAL_ACCESS_TOKEN" \
@@ -16,7 +29,7 @@ if [ -n "$PERSONAL_ACCESS_TOKEN" ]; then
         --replace;
 else
     echo "Using registry token";
-    ./config.sh \
+    runuser -u ubuntu -- ./config.sh \
         --unattended \
         --url $REPOSITORY_URL \
         --token "$REGISTRY_TOKEN" \
@@ -27,4 +40,4 @@ else
         --replace;
 fi
 
-exec "./run.sh"
+exec runuser -u ubuntu -- ./run.sh