diff --git a/build-containers.timer b/build-containers.timer
index 6cd03aa..da02b40 100644
--- a/build-containers.timer
+++ b/build-containers.timer
@@ -4,7 +4,7 @@ Description=Rebuild Forgejo Actions containers
 [Timer]
 OnCalendar=weekly
 Persistent=true
-RandomizedDelaySec=10
+RandomizedDelaySec=10s
 
 [Install]
 WantedBy=timers.target
diff --git a/config.yml b/config.yml
index e5783cc..8e0d18f 100644
--- a/config.yml
+++ b/config.yml
@@ -10,9 +10,8 @@ runner:
   # Execute how many tasks concurrently at the same time.
   capacity: 1
   # Extra environment variables to run jobs.
-  # envs:
-  #   A_TEST_ENV_NAME_1: a_test_env_value_1
-  #   A_TEST_ENV_NAME_2: a_test_env_value_2
+  envs:
+    BUILDAH_ISOLATION: chroot # only possible way to isolate container builds within a container
   # Extra environment variables to run jobs from a file.
   # It will be ignored if it's empty or the file doesn't exist.
   # env_file: .env
@@ -68,7 +67,8 @@ container:
   # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
   privileged: false
   # And other options to be used when the container is started (eg, --add-host=my.forgejo.url:host-gateway).
-  options: "--cpus=1 --memory=1g"
+  # /dev/fuse is needed for the buildah overlayfs storage backend for container builds
+  options: "--cpus=1 --memory=1g --device=/dev/fuse" 
   # The parent directory of a job's working directory.
   # If it's empty, /workspace will be used.
   workdir_parent: