diff --git a/container/runner-config.example.yaml b/container/runner-config.example.yaml
index ece17576..86d78bd5 100644
--- a/container/runner-config.example.yaml
+++ b/container/runner-config.example.yaml
@@ -31,6 +31,12 @@ container:
   # host (create it first: `mkdir -p /var/cache/sccache`), matching SCCACHE_DIR
   # in the workflow.
   options: "--cpus=2 -v /var/cache/sccache:/sccache"
+  # act_runner rejects every bind mount unless it is listed here — the default
+  # is an empty allowlist, so the -v above is dropped with only a
+  # "[...] is not a valid volume, will be ignored" line in the job log, and
+  # SCCACHE_DIR then points at a directory that does not outlive the job.
+  valid_volumes:
+    - /var/cache/sccache
   # Reuse the host VM's Docker network for the built-in cache/artifact server.
   network: "host"
   # The workflow pulls the SDK image by the moving `:latest` tag. Without this