diff --git a/deploy/act-runner.yaml b/deploy/act-runner.yaml
index e9224f9..8e8b083 100644
--- a/deploy/act-runner.yaml
+++ b/deploy/act-runner.yaml
@@ -34,10 +34,19 @@ container:
   privileged: false
   options:
   workdir_parent: workspace
-  # Mount the host's docker socket into job containers that ask for docker, so
-  # `docker.yml` can build and push. `valid_volumes` is the allow-list that
-  # makes any such mount legal at all.
-  docker_host: automount
+  # How job containers get at a docker daemon, which `docker.yml` needs to build
+  # and push the image.
+  #
+  # **Empty is not "off" here.** In act_runner 0.3.x an empty `docker_host` means
+  # "find a docker host and mount it into the job containers" — which is exactly
+  # what is wanted. `"-"` is the value that finds one for the runner but does
+  # *not* pass it to jobs, and `automount` is a later version's spelling of the
+  # default: on 0.3.1 it fails with `unable to parse docker host automount` and
+  # the daemon restart-loops without ever coming online.
+  docker_host: ""
+  # The allow-list for volumes a workflow or a service container may ask for.
+  # The socket is already mounted by the line above; this is what makes an
+  # explicit mount of it legal too, rather than silently dropped.
   valid_volumes:
     - /var/run/docker.sock
   force_pull: false
diff --git a/docs/gitea-runner.md b/docs/gitea-runner.md
index 79e2fbb..a8d25bc 100644
--- a/docs/gitea-runner.md
+++ b/docs/gitea-runner.md
@@ -101,10 +101,15 @@ with its labels listed beside it.
 * **`./data`** holds `.runner`: the runner's identity and its permanent token.
   Back it up or do not delete it; removing it makes the runner register again as a
   *new* one and leaves a dead entry behind in Gitea.
-* **`/var/run/docker.sock`** is mounted so a job can build images. With
-  `docker_host: automount` in `config.yaml`, act_runner passes it into the job
-  container too, which is what lets `docker build` work inside a workflow. Treat it
-  as what it is: any workflow on this runner can do anything to this host's docker.
+* **`/var/run/docker.sock`** is mounted so a job can build images. act_runner
+  passes it into the job container too — on 0.3.x that is what an **empty**
+  `docker_host` in `config.yaml` means, not "disabled". Treat the result as what it
+  is: any workflow on this runner can do anything to this host's docker.
+
+  Watch the spelling here. `docker_host: "-"` finds a daemon for the runner but
+  does *not* give it to jobs, and `docker_host: automount` — the same default
+  spelled out, from a later act_runner — makes 0.3.1 exit with `unable to parse
+  docker host automount` and restart-loop, registered but never online.
 * **The shared `gitea-runner` network.** Job containers join the runner's own
   network (`container.network`), because act_runner's built-in cache server — the
   thing that makes `actions/cache@v4` work — advertises its own address, and from
@@ -183,5 +188,6 @@ re-registering is the honest route.)
 | `uses: actions/checkout@v4` fails to resolve | `DEFAULT_ACTIONS_URL` is not `github` |
 | Cache steps hang | Job containers are not on the runner's network — see `container.network` |
 | `docker: command not found` in a job | That image has no docker CLI; use the `catthehacker` one, which does |
-| `Cannot connect to the Docker daemon` in a job | `docker_host: automount` missing from `config.yaml`, or the socket is not mounted into the runner |
+| `Cannot connect to the Docker daemon` in a job | The socket is not mounted into the runner, or `docker_host` is `"-"` (found for the runner, withheld from jobs) |
+| `unable to parse docker host …`, daemon restart-loops | `docker_host` is set to a word this act_runner does not know — `automount` on 0.3.x. Leave it empty |
 | Everything is slow on the first run | It is pulling the job image. It is cached afterwards |