diff --git a/gitlab-system/gitlab-runner/gitlab-runner.yaml b/gitlab-system/gitlab-runner/gitlab-runner.yaml
index c562d69..ce508f9 100644
--- a/gitlab-system/gitlab-runner/gitlab-runner.yaml
+++ b/gitlab-system/gitlab-runner/gitlab-runner.yaml
@@ -33,9 +33,24 @@
 
       runtimeClassName: kata
 
+      initContainers:
+        - name: init
+          image: docker.io/library/busybox:latest
+
+          command:
+            - sh
+            - -c
+            - cp -v /conf/gitlab-runner/* /etc/gitlab-runner/
+
+          volumeMounts:
+            - name: config-ro
+              mountPath: /conf/gitlab-runner
+            - name: config-rw
+              mountPath: /etc/gitlab-runner
+
       containers:
         - name: master
-          image: docker.benkard.de/mulk/gitlab-runner:miyj7qdmgdbbqk7zkj3wdq0ld9zxdk2z
+          image: docker.benkard.de/mulk/gitlab-runner:8n39akh45p1js8xbky9l0kjwqdyj3c33
 
           securityContext:
             # In a Kata container, this only gives the container full
@@ -47,7 +62,7 @@
 
           volumeMounts:
             # Configuration data.
-            - name: config
+            - name: config-rw
               mountPath: /etc/gitlab-runner
 
             # State.
@@ -57,13 +72,17 @@
               mountPath: /tmp
 
           resources:
+            requests:
+              memory: 128Mi
             limits:
-              memory: 4G
+              memory: 8Gi
 
       volumes:
-        - name: config
+        - name: config-ro
           secret:
             secretName: gitlab-runner-config
+        - name: config-rw
+          emptyDir: {}
         - name: docker-data
           persistentVolumeClaim:
             claimName: gitlab-runner-docker
diff --git a/gitlab-system/gitlab.yaml b/gitlab-system/gitlab.yaml
index ec8eced..213ab83 100644
--- a/gitlab-system/gitlab.yaml
+++ b/gitlab-system/gitlab.yaml
@@ -5,7 +5,7 @@
   namespace: gitlab-system
 spec:
   chart:
-    version: "6.7.1"
+    version: "6.7.5"
     values:
       global:
         appConfig:
diff --git a/makefile b/makefile
index 44f6f85..ff7e8f5 100644
--- a/makefile
+++ b/makefile
@@ -12,7 +12,7 @@
 IMAGES_BIN = $(patsubst %,%.bin,$(IMAGES))
 IMAGES_LOAD = $(patsubst %,%.load,$(IMAGES))
 
-.PHONY: all images clean init gc #$(IMAGES_LOAD)
+.PHONY: all images clean init gc update #$(IMAGES_LOAD)
 
 all: images
 
@@ -30,6 +30,9 @@
 init:
 	$(NIX_DOCKER_MAINT) sh -c 'nix-env -iA nixpkgs.rsync && rsync --info=progress2 -a /nix/ /nix2/'
 
+update:
+	$(NIX_DOCKER) sh -c 'nix-channel --update'
+
 # Builds and loads all known Docker images.
 images: $(IMAGES_LOAD)