diff --git a/app/pyproject.toml b/app/pyproject.toml
index 227ed7fa..85eae8cc 100644
--- a/app/pyproject.toml
+++ b/app/pyproject.toml
@@ -3,7 +3,7 @@
 
 [project]
 name = "github-runner-image-builder"
-version = "0.14.2"
+version = "0.14.3"
 authors = [
     { name = "Canonical IS DevOps", email = "is-devops-team@canonical.com" },
 ]
diff --git a/app/src/github_runner_image_builder/templates/cloud-init.sh.j2 b/app/src/github_runner_image_builder/templates/cloud-init.sh.j2
index b1e4cb8b..e9aebdda 100644
--- a/app/src/github_runner_image_builder/templates/cloud-init.sh.j2
+++ b/app/src/github_runner_image_builder/templates/cloud-init.sh.j2
@@ -195,6 +195,15 @@ function configure_system_users() {
     # removes /run/user/<uid> once the last session ends. A runner started as a system service
     # has no login session, so linger is what keeps both alive.
     /usr/bin/loginctl enable-linger ubuntu
+    # The GARM agent runs the runner from that system service, so jobs lack what a login session
+    # provides (XDG_RUNTIME_DIR, the user D-Bus bus) and tools like skopeo and podman fall back to
+    # the root-owned /run/containers. A PAM session restores it, as `su -` did for the previous
+    # runner manager; systemd applies the drop-in once GARM installs garm-agent.service.
+    /usr/bin/mkdir -p /etc/systemd/system/garm-agent.service.d
+    /usr/bin/cat > /etc/systemd/system/garm-agent.service.d/login-session.conf <<EOF
+[Service]
+PAMName=su-l
+EOF
 
     # Create runner user as alias to ubuntu for GARM compatibility.
     # GARM expects a runner user with /home/runner/actions-runner path.
diff --git a/app/tests/integration/commands.py b/app/tests/integration/commands.py
index 71c0dd38..860cd8ee 100644
--- a/app/tests/integration/commands.py
+++ b/app/tests/integration/commands.py
@@ -31,6 +31,10 @@ class Commands:
 TEST_RUNNER_COMMANDS = (
     Commands(name="simple hello world", command="echo hello world"),
     Commands(name="print groups", command="groups | grep sudo"),
+    Commands(
+        name="check garm-agent login session drop-in",
+        command="grep -x PAMName=su-l /etc/systemd/system/garm-agent.service.d/login-session.conf",
+    ),
     Commands(name="file permission to /usr/local/bin", command="ls -ld /usr/local/bin"),
     Commands(
         name="file permission to /usr/local/bin (create)", command="touch /usr/local/bin/test_file"
diff --git a/app/tests/unit/test_openstack_builder.py b/app/tests/unit/test_openstack_builder.py
index 2125c1b9..bc7e2b64 100644
--- a/app/tests/unit/test_openstack_builder.py
+++ b/app/tests/unit/test_openstack_builder.py
@@ -929,6 +929,15 @@ def test__generate_cloud_init_script(
     # removes /run/user/<uid> once the last session ends. A runner started as a system service
     # has no login session, so linger is what keeps both alive.
     /usr/bin/loginctl enable-linger ubuntu
+    # The GARM agent runs the runner from that system service, so jobs lack what a login session
+    # provides (XDG_RUNTIME_DIR, the user D-Bus bus) and tools like skopeo and podman fall back to
+    # the root-owned /run/containers. A PAM session restores it, as `su -` did for the previous
+    # runner manager; systemd applies the drop-in once GARM installs garm-agent.service.
+    /usr/bin/mkdir -p /etc/systemd/system/garm-agent.service.d
+    /usr/bin/cat > /etc/systemd/system/garm-agent.service.d/login-session.conf <<EOF
+[Service]
+PAMName=su-l
+EOF
 
     # Create runner user as alias to ubuntu for GARM compatibility.
     # GARM expects a runner user with /home/runner/actions-runner path.
diff --git a/docs/changelog.md b/docs/changelog.md
index 7ca0fa0d..97289961 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -1,5 +1,9 @@
 <!-- vale Canonical.007-Headings-sentence-case = NO -->
 
+## [#245 Run the GARM agent in a login session](https://github.com/canonical/github-runner-image-builder-operator/pull/245) (2026-10-08)
+
+- Run the runner started by the GARM agent in a PAM login session, as the previous runner manager did with `su -`. The agent runs as a system service, so jobs had no `XDG_RUNTIME_DIR` or user D-Bus bus, and tools that keep per-user state there, such as `skopeo login`, `podman` and `buildah`, failed with `mkdir /run/containers: permission denied`.
+
 ## [#244](https://github.com/canonical/github-runner-image-builder-operator/pull/244) (2026-09-23)
 
 - Ensure the `runner` group alongside the `runner` user.