diff --git a/krebs/1systems/wolf/config.nix b/krebs/1systems/wolf/config.nix
index ec8830711..995e49669 100644
--- a/krebs/1systems/wolf/config.nix
+++ b/krebs/1systems/wolf/config.nix
@@ -26,6 +26,7 @@ in
     <stockholm/krebs/2configs/shack/radioactive.nix>
     <stockholm/krebs/2configs/shack/share.nix>
     <stockholm/krebs/2configs/shack/mobile.mpd.nix>
+    <stockholm/krebs/2configs/shack/gitlab-runner.nix>
     {
       systemd.services.telegraf.path = [ pkgs.net_snmp ]; # for snmptranslate
       systemd.services.telegraf.environment = {
diff --git a/krebs/2configs/shack/gitlab-runner.nix b/krebs/2configs/shack/gitlab-runner.nix
new file mode 100644
index 000000000..57d670ea3
--- /dev/null
+++ b/krebs/2configs/shack/gitlab-runner.nix
@@ -0,0 +1,21 @@
+{ pkgs, ... }:
+let
+  runner-src = builtins.fetchTarball {
+    url = "https://gitlab.com/arianvp/nixos-gitlab-runner/-/archive/master/nixos-gitlab-runner-master.tar.gz";
+    sha256 = "1s0fy5ny2ygcfvx35xws8xz5ih4z4kdfqlq3r6byxpylw7r52fyi";
+  };
+in
+{
+  systemd.services.gitlab-runner.path = [
+    "/run/wrappers" # /run/wrappers/bin/su
+    "/" # /bin/sh
+  ];
+  imports = [ 
+    "${runner-src}/gitlab-runner.nix"
+  ];
+  services.gitlab-runner2.enable = true;
+  ## registrationConfigurationFile contains:
+  # CI_SERVER_URL=<CI server URL>
+  # REGISTRATION_TOKEN=<registration secret>
+  services.gitlab-runner2.registrationConfigFile = <secrets/shackspace-gitlab-ci>;
+}