diff --git a/cmd/github-actions-runner-job/Dockerfile b/cmd/github-actions-runner-job/Dockerfile
index e10fc24..6016ead 100644
--- a/cmd/github-actions-runner-job/Dockerfile
+++ b/cmd/github-actions-runner-job/Dockerfile
@@ -23,13 +23,15 @@ RUN set -eux; \
   echo "${runner_sha256}  /opt/actions-runner/actions-runner.tar.gz" | sha256sum -c -; \
   tar -tzf /opt/actions-runner/actions-runner.tar.gz ./config.sh ./run.sh >/dev/null; \
   chmod 0644 /opt/actions-runner/actions-runner.tar.gz; \
-  useradd -m -s /bin/bash runner
+  useradd -m -s /bin/bash runner; \
+  mkdir -p /workspace; \
+  chown runner:runner /workspace
 
 COPY --chmod=0755 ${RUNNER_JOB_BINARY} /usr/local/bin/github-actions-runner-job
 COPY --chmod=0755 cmd/github-actions-runner-job/entrypoint.sh /usr/local/bin/github-actions-runner-job-entrypoint
 
 USER runner
-WORKDIR /home/runner
+WORKDIR /workspace
 ENV GITHUB_ACTIONS_RUNNER_ARCHIVE=/opt/actions-runner/actions-runner.tar.gz
-ENV GITHUB_ACTIONS_RUNNER_DIR=/home/runner/actions-runner
+ENV GITHUB_ACTIONS_RUNNER_DIR=/workspace/.github-actions-runner
 ENTRYPOINT ["/usr/local/bin/github-actions-runner-job-entrypoint"]
diff --git a/cmd/github-actions-runner-job/entrypoint.sh b/cmd/github-actions-runner-job/entrypoint.sh
index 2901df6..bd147b0 100644
--- a/cmd/github-actions-runner-job/entrypoint.sh
+++ b/cmd/github-actions-runner-job/entrypoint.sh
@@ -2,7 +2,7 @@
 set -euo pipefail
 
 archive="${GITHUB_ACTIONS_RUNNER_ARCHIVE:-/opt/actions-runner/actions-runner.tar.gz}"
-runner_dir="${GITHUB_ACTIONS_RUNNER_DIR:-/home/runner/actions-runner}"
+runner_dir="${GITHUB_ACTIONS_RUNNER_DIR:-/workspace/.github-actions-runner}"
 
 if [ ! -f "$archive" ]; then
   echo "github-actions-runner-job: runner archive not found at $archive" >&2
@@ -10,6 +10,7 @@ if [ ! -f "$archive" ]; then
 fi
 
 if [ ! -x "$runner_dir/config.sh" ]; then
+  mkdir -p "$(dirname "$runner_dir")"
   mkdir -p "$runner_dir"
   tar --no-same-owner -xzf "$archive" -C "$runner_dir"
 fi
diff --git a/release_packaging_test.go b/release_packaging_test.go
index 58eea4a..2c4fefe 100644
--- a/release_packaging_test.go
+++ b/release_packaging_test.go
@@ -108,8 +108,11 @@ func TestGitHubActionsRunnerJobImageCarriesCompressedRunnerArchive(t *testing.T)
 		`arm64) runner_sha256="69ac7e5692f877189e7dddf4a1bb16cbbd6425568cd69a0359895fac48b9ad3b"`,
 		`echo "${runner_sha256}  /opt/actions-runner/actions-runner.tar.gz" | sha256sum -c -`,
 		"tar -tzf /opt/actions-runner/actions-runner.tar.gz ./config.sh ./run.sh >/dev/null",
+		"mkdir -p /workspace",
+		"chown runner:runner /workspace",
 		"GITHUB_ACTIONS_RUNNER_ARCHIVE=/opt/actions-runner/actions-runner.tar.gz",
-		"GITHUB_ACTIONS_RUNNER_DIR=/home/runner/actions-runner",
+		"GITHUB_ACTIONS_RUNNER_DIR=/workspace/.github-actions-runner",
+		"WORKDIR /workspace",
 		"COPY --chmod=0755 cmd/github-actions-runner-job/entrypoint.sh /usr/local/bin/github-actions-runner-job-entrypoint",
 		`ENTRYPOINT ["/usr/local/bin/github-actions-runner-job-entrypoint"]`,
 	} {
@@ -125,9 +128,10 @@ func TestGitHubActionsRunnerJobImageCarriesCompressedRunnerArchive(t *testing.T)
 	entrypointText := string(entrypoint)
 	for _, want := range []string{
 		"${GITHUB_ACTIONS_RUNNER_ARCHIVE:-/opt/actions-runner/actions-runner.tar.gz}",
-		"${GITHUB_ACTIONS_RUNNER_DIR:-/home/runner/actions-runner}",
+		"${GITHUB_ACTIONS_RUNNER_DIR:-/workspace/.github-actions-runner}",
 		`[ ! -f "$archive" ]`,
 		"runner archive not found",
+		`mkdir -p "$(dirname "$runner_dir")"`,
 		`tar --no-same-owner -xzf "$archive" -C "$runner_dir"`,
 		`exec /usr/local/bin/github-actions-runner-job "$@"`,
 	} {
@@ -135,6 +139,11 @@ func TestGitHubActionsRunnerJobImageCarriesCompressedRunnerArchive(t *testing.T)
 			t.Fatalf("runner job entrypoint must include %q", want)
 		}
 	}
+	if strings.Contains(dockerfile, "WORKDIR /home/runner") ||
+		strings.Contains(dockerfile, "GITHUB_ACTIONS_RUNNER_DIR=/home/runner/actions-runner") ||
+		strings.Contains(entrypointText, "GITHUB_ACTIONS_RUNNER_DIR:-/home/runner/actions-runner") {
+		t.Fatal("runner job image must extract the runner under the writable /workspace mount, not /home/runner")
+	}
 }
 
 func TestReleaseArchiveCheckRejectsProviderBuildOutsideArchive(t *testing.T) {