diff --git a/hosts/linode/default.nix b/hosts/linode/default.nix
index 09c5114..3c9cb84 100644
--- a/hosts/linode/default.nix
+++ b/hosts/linode/default.nix
@@ -16,11 +16,6 @@
     ./postgres.nix
   ];
 
-  age.secrets.runner-deployer = {
-    file = ../../secrets/gitlab/linode-deployer-runner-reg.age;
-    owner = "gitlab-runner";
-  };
-
   environment.systemPackages = with pkgs; [
     bind
     graphviz
@@ -55,25 +50,12 @@
   ];
 
   services = {
-    gitlab-runner = {
-      enable = true;
-      services.deployer = {
-        executor = "shell";
-        authenticationTokenConfigFile = config.age.secrets.runner-deployer.path;
-      };
-    };
-
     immich-public-proxy = {
       enable = true;
       immichUrl = "https://immich.shire-zebra.ts.net";
     };
   };
 
-  systemd.services."gitlab-runner".serviceConfig = {
-    DynamicUser = lib.mkForce false;
-    User = "gitlab-runner";
-  };
-
   security.sudo.extraRules = [
     {
       users = [ "gitlab-runner" ];
@@ -89,12 +71,4 @@
       ];
     }
   ];
-
-  users = {
-    groups.gitlab-runner = { };
-    users.gitlab-runner = {
-      isSystemUser = true;
-      group = "gitlab-runner";
-    };
-  };
 }
diff --git a/hosts/linode/git.nix b/hosts/linode/git.nix
index c0cbb95..6bd2196 100644
--- a/hosts/linode/git.nix
+++ b/hosts/linode/git.nix
@@ -87,8 +87,15 @@ in
 
   networking.firewall.allowedTCPPorts = [ sshPort ];
 
-  systemd.services.haproxy = {
-    after = [ "sys-devices-virtual-net-tailscale0.device" ];
+  systemd.services = {
+    haproxy = {
+      after = [
+        "network-online.target"
+      ];
+      wants = [
+        "network-online.target"
+      ];
+    };
   };
 
   services.haproxy = {