diff --git a/nixos/boxes/colony/vms/git/default.nix b/nixos/boxes/colony/vms/git/default.nix
index 4334cfe..1687823 100644
--- a/nixos/boxes/colony/vms/git/default.nix
+++ b/nixos/boxes/colony/vms/git/default.nix
@@ -38,6 +38,8 @@ in
       let
         inherit (lib) mkMerge;
         inherit (lib.my) networkdAssignment;
+
+        podmanSubnet = "10.88.0.0/16";
       in
       {
         imports = [
@@ -158,7 +160,7 @@ in
               oci-containers = {
                 backend = "podman";
               };
-              containers.containersConf.settings.network.default_subnet = "10.88.0.0/16";
+              containers.containersConf.settings.network.default_subnet = podmanSubnet;
             };
 
             systemd.network = {
@@ -195,7 +197,7 @@ in
                 extraRules = ''
                   table inet filter {
                     chain forward {
-                      ip saddr 10.88.0.0/16 accept
+                      ip saddr ${podmanSubnet} accept
                     }
                   }
                 '';
diff --git a/nixos/boxes/colony/vms/git/gitea-actions.nix b/nixos/boxes/colony/vms/git/gitea-actions.nix
index 5c96c3e..3d310ab 100644
--- a/nixos/boxes/colony/vms/git/gitea-actions.nix
+++ b/nixos/boxes/colony/vms/git/gitea-actions.nix
@@ -1,7 +1,14 @@
 { lib, pkgs, config, ... }:
 let
   inherit (lib) mkForce;
+  inherit (lib.my) net;
   inherit (lib.my.c) pubDomain;
+
+  # The podman bridge gateway (first host of the default subnet); job
+  # containers reach the runner's artifact cache server here, through a single
+  # fixed port opened in the firewall below.
+  podmanGateway = net.cidr.host 1 config.virtualisation.containers.containersConf.settings.network.default_subnet;
+  cachePort = 34567;
 in
 {
   config = {
@@ -34,6 +41,11 @@ in
             cache = {
               enabled = true;
               dir = "/var/cache/gitea-runner";
+              # Announce the podman bridge gateway rather than let act_runner
+              # autodetect the box's outbound address, which containers can't
+              # route back to.
+              host = podmanGateway;
+              port = cachePort;
             };
           };
         };
@@ -73,6 +85,15 @@ in
           group = "gitea-runner";
         };
       };
+
+      # Let job containers reach the runner's artifact cache server on the host.
+      firewall.extraRules = ''
+        table inet filter {
+          chain input {
+            iifname "podman0" tcp dport ${toString cachePort} accept
+          }
+        }
+      '';
     };
   };
 }