Bake Harden-Runner Into GitHub's Custom Runner Images for Organization-Wide CI/CD Security

GitHub has introduced custom runner images, now in public preview, that allow Harden-Runner to be baked directly into runner images. This lets organisations embed automatic runtime protection across all workflows without modifying any workflow files. The baked-in agent runs as part of the infrastructure, so every job using the custom image automatically inherits runtime protection with no changes to workflows needed.

The approach offers transparent security, centralised control through runner image lifecycle management, and consistent policy enforcement when policies are attached via the Policy Store. It also enables gradual migration since there is no conflict with existing workflows, and installation instructions for the Harden-Runner are available under Settings → Harden-Runner Installation. Ashish Kurmi is the author of the piece, published on 16 December 2025.