diff --git a/scripts/install-gitea-runner.sh b/scripts/install-gitea-runner.sh
index bfa1b97..73cf870 100755
--- a/scripts/install-gitea-runner.sh
+++ b/scripts/install-gitea-runner.sh
@@ -26,6 +26,17 @@ if [ -z "$TOKEN" ] || [ -z "$NAME" ] || [ -z "$LABELS" ]; then
     exit 1
 fi
 
+# ── 0. Require root ────────────────────────────────────────────────
+if [ "$(id -u)" -ne 0 ]; then
+    echo "❌ This script must be run as root."
+    if [ -f /etc/alpine-release ]; then
+        echo "   Use: doas $0 $*"
+    else
+        echo "   Use: sudo $0 $*"
+    fi
+    exit 1
+fi
+
 # ── 0. Detect OS + privilege elevation method ──────────────────────
 if [ -f /etc/alpine-release ]; then
     OS="alpine"