Ok the problem was solved by using the manual update described at:

https://docs.gitlab.com/runner/install/linux-manually.html

Stop the service (you need elevated command prompt as before):

sudo gitlab-runner stop

Download the binary to replace Runner's executable:

sudo wget -O /usr/local/bin/gitlab-runner https://gitlab-runner-downloads.s3.amazonaws.com/latest/binaries/gitlab-runner-linux-386
sudo wget -O /usr/local/bin/gitlab-runner https://gitlab-runner-downloads.s3.amazonaws.com/latest/binaries/gitlab-runner-linux-amd64

You can download a binary for every available version as described in Bleeding Edge - download any other tagged release.

Give it permissions to execute:

sudo chmod +x /usr/local/bin/gitlab-runner

Start the service:

sudo gitlab-runner start

"latest" - may install a beta so it is important to select the right tag (also described in the link)

Answer from Jan S. on Stack Overflow
🌐
GitLab
docs.gitlab.com › gitlab docs › administer › administer gitlab runner
GitLab Runner | GitLab Docs
If you host your own runners but host your repositories on GitLab.com, keep GitLab Runner updated to the latest version, as GitLab.com is updated continuously.
GitLab Docs
Learn how to use and administer GitLab, the most scalable Git-based fully integrated platform for software development.
Register a runner
If you used a configuration volume other than /srv/gitlab-runner/config during installation, update the command with the correct volume.
Runner executors
GitLab Runner implements different executors that can be used to run your builds in different environments: ... Other executors are available that are not under active feature development. They receive critical security updates but no new features.
Configure runners
After you reset the registration ... the project. You should also update the registration token in tools you use to provision and register new values. Each runner uses a runner authentication token to connect to and authenticate with a GitLab instance....
Discussions

GitLab runner upgrade
Hi Team, Current GitLab version: 18.1.3 ; OS: Rocky Linux 9.5 Current GitLab-Runner version: 18.1.3 ; OS: Ubuntu 20.04 Please note GitLab server and GitLab-Runner is on different servers. I wanted to upgrade my production GitLab server from 18.1.3 to 18.7.1. I assume that the upgrade path would ... More on forum.gitlab.com
🌐 forum.gitlab.com
2
0
January 22, 2026
How do you keep your Gitlab runners up to date?
We opted for using their RPM repo with auto update enabled, but for different times. So that if something is wrong in the update it won't touch all of them at once More on reddit.com
🌐 r/gitlab
8
7
February 8, 2023
Gitlab Runner Install & Updates
2 options off the top of my head AWS Systems Manager/ Patch Manager Opsworks I think Patch Manager will run the patching automatically based on a calendar you setup. I use Opsworks where I have a specific recipe that does the updates and reboots the instance. I tell the recipe to run and pick all the instances in the stack I want to have the command ran on. More on reddit.com
🌐 r/gitlab
9
1
May 22, 2023
Upgrade path for runner
Although the documentation says (from Upgrading GitLab | GitLab) "it is very important to upgrade GitLab Runner to match the GitLab minor version that was upgraded to. ", our setup has worked fine with runners not being upgraded and getting further and further behind (we have several servers ... More on forum.gitlab.com
🌐 forum.gitlab.com
2
2
July 8, 2022
🌐
GitLab
docs.gitlab.com › gitlab docs › install › install gitlab runner › linux
Install GitLab Runner using the official GitLab repositories | GitLab Docs
The GitLab Runner project provides two types of GPG signatures for the package installation method: ... To verify that the package information downloaded from the remote repository can be trusted, the package manager uses repository metadata signing. The signature is verified when you use a command like apt-get update, so the information about available packages is updated before any package is downloaded and installed.
🌐
GitLab
forum.gitlab.com › how to use gitlab › upgrade
GitLab runner upgrade - Upgrade - GitLab Forum
January 22, 2026 - Hi Team, Current GitLab version: 18.1.3 ; OS: Rocky Linux 9.5 Current GitLab-Runner version: 18.1.3 ; OS: Ubuntu 20.04 Please note GitLab server and GitLab-Runner is on different servers. I wanted to upgrade my production GitLab server from 18.1.3 to 18.7.1. I assume that the upgrade path would ...
🌐
GitLab
gitlab.com › gitlab.org › gitlab-runner › releases
Releases · GitLab.org / gitlab-runner · GitLab
August 13, 2026 - GitLab Runner is the open source project that is used to run your CI/CD jobs and send the results back to GitLab
🌐
GitLab
gitlab.com › gitlab.org › charts › gitlab runner › repository
CHANGELOG.md · main · GitLab.org / charts / GitLab Runner · GitLab
1 week ago - Fix the register-the-runner script !479 (merged) (Jeremy Huntwork @jhuntwork) Remove registration token integration test !477 (merged) ... Fix replicas value check for nil to work also with Terraform !478 (merged) (Sabyrzhan Tynybayev @sabyrzhan) Update list of rules to be added to the rbac role permissions as per documentation !471 (merged) (Ismael Posada Trobo @iposadat)
Find elsewhere
🌐
Reddit
reddit.com › r/gitlab › gitlab runner install & updates
r/gitlab on Reddit: Gitlab Runner Install & Updates
May 22, 2023 -

Hello, We host our products on AWS Cluster. We have multiple products and clusters that are deployed on their respective AWS Account that we "Switch Role" to. For each Group of Product we have multiple environments (DEV/UAT/PROD).

We create CFN stack for our Bastion host (Private Subnet) and from that Bastion Host we create another EC2 instance (Private Subnet) that acts as our GitLab Runner for the Group for a particular environment.

This way we are ending up with many Runners (custom and not shared).

Question:

I was wondering how to manage these runners if we have to push any changes to the runner's themselves (let's say install a software or patching etc) without manually logging into them individually or Creating them new from the Bastion.

We are open to adopting a different runner creation setup if this is not ideal.

Top answer
1 of 3
1
2 options off the top of my head AWS Systems Manager/ Patch Manager Opsworks I think Patch Manager will run the patching automatically based on a calendar you setup. I use Opsworks where I have a specific recipe that does the updates and reboots the instance. I tell the recipe to run and pick all the instances in the stack I want to have the command ran on.
2 of 3
1
As u/jwestbrook mentions, using AWS Systems Manager is one way you can manage the configuration of multiple systems and avoid the problem of managing these systems directly and individually. You can, for example, use Systems Manager to run ansible playbooks to reach a desired configuration (e.g., installing software packages) across many systems all at once via the Systems Manager agent -- no bastions needed. That said, I would suggest that you avoid this problem altogether in the first place by not fragmenting your runners into every network segment in which you need a runner to access. As you mention, this increases complexity of managing runners registrations, tags, etc. -- it also fragments your available resources, complicates access control, among other concerns. As a quick side note: I would also suggest use of container-based executors, like the docker executor. This way, you really don't have to worry about ensuring software is installed to begin with. You can just publish a docker image containing the required software and the runner can use new images without any configuration changes. Instead, it is ideal if you have a single unified pool of shared runners -- they can potentially be deployed in their own AWS account, just like any of your other 'products'. It may be helpful if you think of your runners as you would with gitlab.com shared runners. Every runner should be unprivileged by default (except perhaps to pull necessary docker images). How, exactly, you implement this depends on a lot of details, but the end goal is that every job is able to obtain appropriate (and temporary) access in a just-in-time manner and does not rely on the runner to gain any privileges -- just as you would do if your jobs ran on gitlab.com shared runners. One major part of implementing this is to use OIDC federation with GitLab and AWS to obtain access to IAM roles appropriately scoped for the project for each job that needs AWS access. That role can also have delegated permission in multiple AWS accounts, including assuming roles in different accounts, obtaining secrets, or whatever it needs to do.
🌐
GitLab
forum.gitlab.com › how to use gitlab › upgrade
Upgrade path for runner - Upgrade - GitLab Forum
July 8, 2022 - Although the documentation says (from Upgrading GitLab | GitLab) "it is very important to upgrade GitLab Runner to match the GitLab minor version that was upgraded to. ", our setup has worked fine with runners not being upgraded and getting further and further behind (we have several servers with several different versions of gitlab-runner).
🌐
mixable Blog
mixable.blog › home › install and update gitlab runner
Install and update GitLab Runner | mixable Blog
May 3, 2024 - Now you can start the container as described in the section Start GitLab Runner below. To update GitLab Runner, you also have to pull the container by using:
🌐
GitLab
docs.gitlab.com › gitlab docs › administer › administer gitlab runner › register a runner › migrate to the new runner registration workflow
Migrating to the new runner registration workflow | GitLab Docs
The remaining runner managers continue to use the invalid token and become disconnected. You must update these managers manually to use the new token. During runner registration with GitLab Operator through the new workflow, the runner authentication token in the Custom Resource Definition doesn’t update during token rotation.
🌐
DEV Community
dev.to › marocz › my-journey-upgrading-gitlab-and-gitlab-runner-on-aws-ec2-4anf
My Journey Upgrading GitLab and GitLab Runner on AWS EC2 - DEV Community
October 8, 2023 - curl -L https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.rpm.sh | sudo bash
🌐
GitLab
gitlab.com › gitlab.org › gitlab-runner › repository
CHANGELOG.md · main · GitLab.org / gitlab-runner · GitLab
Update PowerShell UTF8 integration test !5493 (Guillaume Chauvel @guillaume.chauvel) ... Allow to install/manipulate the gitlab-runner service as a user service (systemd) !5534 (Tiago Teixeira @tiago.teixeira.erx)
🌐
GitLab
forum.gitlab.com › how to use gitlab › upgrade
Gitlab-runner --version still shows previous version after upgrade - Upgrade - GitLab Forum
March 18, 2024 - My organization upgraded our self-managed GitLab version (to GitLab Community Edition v16.9.2). So I was asked to upgrade the GitLab Runners of my team. I upgraded gitlab-runner from 15.0.0 to 19.6.9-1 on the machine where our runners are installed with: sudo apt-get update curl -L "https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.deb.sh" | sudo bash apt-cache madison gitlab-runner sudo apt-get install gitlab-runner=16.9.1-1 The upgrade completed successfully.
🌐
DevOps as Craft
virtualizare.net › devops › how-to-update-gitlab-runner-a-step-by-step-guide.html
How to Update GitLab Runner: A Step-by-Step Guide
March 28, 2024 - Locate your GitLab Runner’s configuration file, typically found at /etc/gitlab-runner/config.toml on Linux systems. Use the cp command to make a copy of the config.toml file and store it in a secure location. If you’re using a Docker executor, remember to also back up your Docker volumes and any associated data. Ensuring that you have a reliable backup allows you to approach the update with confidence, knowing that your configurations and data are safe.
Top answer
1 of 8
17

Official answer for this problem (source of the text from the following link):

https://docs.gitlab.com/omnibus/update/package_signatures#update-keys-after-expiry-extension

Update keys after expiry extension

For Debian based distributions:

PackageCloud generally made use of apt-key, which will be deprecated in the future. Manually installed or configured repositories from some distributions are already using the signed-by support within Debian package source lists.

  1. Determine if you’re using apt-key or signed-by functionality:

     grep 'deb \[signed-by=' /etc/apt/sources.list.d/gitlab_gitlab-?e.list
    
  2. If this grep returns any lines, you're using signed-by functionality. This takes precedence over any apt-key usage. If this grep returns no lines, you're using apt-key functionality.

    For signed-by, the following script (run as root) updates the public keys for GitLab repositories:

    awk '/deb \[signed-by=/{
        pubkey = $2;
        sub(/\[signed-by=/, "", pubkey);
        sub(/\]$/, "", pubkey);
        print pubkey
      }' /etc/apt/sources.list.d/gitlab_gitlab-?e.list | \
    while read line; do
      curl -s "https://packages.gitlab.com/gpg.key" | gpg --dearmor > $line
    done
    
  3. For apt-key, the following script (run as root) updates the public keys for GitLab repositories:

    apt-key del 3F01618A51312F3F  
    curl -s "https://packages.gitlab.com/gpg.key" | apt-key add -
    apt-key list 3F01618A51312F3F
    
2 of 8
11

You can use the same step that is described in the installation script:

curl -fsSL "https://packages.gitlab.com/runner/gitlab-runner/gpgkey" | gpg --dearmor > /usr/share/keyrings/runner_gitlab-runner-archive-keyring.gpg

then

apt update

You can use the same to fix gitlab-ce and gitlab-ee

curl -fsSL "https://packages.gitlab.com/runner/gitlab-runner/gpgkey" | gpg --dearmor > /usr/share/keyrings/gitlab_gitlab-ee-archive-keyring.gpg
curl -fsSL "https://packages.gitlab.com/runner/gitlab-runner/gpgkey" | gpg --dearmor > /usr/share/keyrings/gitlab_gitlab-ce-archive-keyring.gpg
🌐
GitLab
docs.gitlab.com › gitlab docs › administer › administer gitlab runner › register a runner
Registering runners | GitLab Docs
$ sudo gitlab-runner register \ --template-config /tmp/test-config.template.toml \ --non-interactive \ --url "https://gitlab.com" \ --token <TOKEN> \ "# --registration-token if using the deprecated runner registration token" --name test-runner \ --executor kubernetes --host = "http://localhost:9876/" The environment variable in the .gitlab.yaml file: ... If you update the environment variable, you do not need to add the file path in the register command each time you register.