diff --git a/ansible/roles/act_runner/templates/config.yml.j2 b/ansible/roles/act_runner/templates/config.yml.j2
index bb8d365..89acd33 100644
--- a/ansible/roles/act_runner/templates/config.yml.j2
+++ b/ansible/roles/act_runner/templates/config.yml.j2
@@ -17,5 +17,7 @@ container:
   privileged: false
   valid_volumes:
     - /tmp
-  force_pull: false
+  force_pull: true     # otherwise a job container image update (e.g. a build-image
+                       # rebuild pushed to :latest) is silently ignored — the runner
+                       # just reuses whatever it already has cached under that tag
   force_rebuild: false