As @iwalker says: option 3. We generally don’t keep the versions of GitLab and gitlab-runner in sync (GitLab is generally close to the latest, the runner is just “not very old” - and we know that’s contrary to the general advice) and that works fine. So any of your options would probably work, but … Answer from grove on forum.gitlab.com
🌐
GitLab
docs.gitlab.com › gitlab docs › administer › administer gitlab runner
GitLab Runner | GitLab Docs
If you host your own runners but host your repositories on GitLab.com, keep GitLab Runner updated to the latest version, as GitLab.com is updated continuously.
GitLab Docs
Learn how to use and administer GitLab, the most scalable Git-based fully integrated platform for software development.
Register a runner
If you used a configuration volume other than /srv/gitlab-runner/config during installation, update the command with the correct volume.
Runner executors
GitLab Runner implements different executors that can be used to run your builds in different environments: ... Other executors are available that are not under active feature development. They receive critical security updates but no new features.
Configure runners
After you reset the registration ... the project. You should also update the registration token in tools you use to provision and register new values. Each runner uses a runner authentication token to connect to and authenticate with a GitLab instance....
🌐
GitLab
docs.gitlab.com › gitlab docs › install › install gitlab runner › linux
Install GitLab Runner using the official GitLab repositories | GitLab Docs
GitLab provides packages for the following supported versions of Linux distributions. New runner deb or rpm packages for new OS distribution releases are added automatically when supported by our package hosting system.
Discussions

GitLab runner upgrade
Hi Team, Current GitLab version: 18.1.3 ; OS: Rocky Linux 9.5 Current GitLab-Runner version: 18.1.3 ; OS: Ubuntu 20.04 Please note GitLab server and GitLab-Runner is on different servers. I wanted to upgrade my production GitLab server from 18.1.3 to 18.7.1. I assume that the upgrade path would ... More on forum.gitlab.com
🌐 forum.gitlab.com
2
0
January 22, 2026
How to upgrade to a new installed gitlab runner version? - Stack Overflow
I try to update my single gitlab runner from 11.0 to 11.3.1 and followed the instruction on the gitlab doc. sudo apt-get install gitlab-runner will confirm that I have the new version installed: More on stackoverflow.com
🌐 stackoverflow.com
How do you keep your Gitlab runners up to date?
We opted for using their RPM repo with auto update enabled, but for different times. So that if something is wrong in the update it won't touch all of them at once More on reddit.com
🌐 r/gitlab
8
7
February 8, 2023
Gitlab Runner Install & Updates
2 options off the top of my head AWS Systems Manager/ Patch Manager Opsworks I think Patch Manager will run the patching automatically based on a calendar you setup. I use Opsworks where I have a specific recipe that does the updates and reboots the instance. I tell the recipe to run and pick all the instances in the stack I want to have the command ran on. More on reddit.com
🌐 r/gitlab
9
1
May 22, 2023
🌐
GitLab
docs.gitlab.com › gitlab docs › extend › gitlab cli (glab) › commands › glab runner › glab runner update
glab runner update | GitLab Docs
# Pause a runner glab runner update <runner-id> --pause # Unpause a runner glab runner update <runner-id> --unpause # Pause a runner in a specific project glab runner update <runner-id> --pause -R owner/repo
🌐
GitLab
gitlab.com › gitlab.org › gitlab-runner › repository
CHANGELOG.md · main · GitLab.org / gitlab-runner · GitLab
1 week ago - Fix jobs stuck in canceling due to missing final update !6770 (merged) clear-docker-cache: fall back to podman when docker is absent !6755 (merged) Fix concrete execution divergences from abstract shell !6801 (merged) Silence exec-cleanup warning under Podman !6773 (merged) Fix Bash script body leak on job cancellation !6784 (merged) clear-docker-cache: drop unsupported -a from podman volume prune !6808 (merged) ... Add LTSC2025 and LTSC2025-arm64 based gitlab-runner-helper images for windows !6033 (merged) (Shanush Prema Thasarathan @shanushpt)
🌐
GitLab
forum.gitlab.com › how to use gitlab › upgrade
GitLab runner upgrade - Upgrade - GitLab Forum
January 22, 2026 - Hi Team, Current GitLab version: 18.1.3 ; OS: Rocky Linux 9.5 Current GitLab-Runner version: 18.1.3 ; OS: Ubuntu 20.04 Please note GitLab server and GitLab-Runner is on different servers. I wanted to upgrade my production GitLab server from 18.1.3 to 18.7.1. I assume that the upgrade path would ...
🌐
GitLab
gitlab.com › gitlab.org › gitlab-runner › releases
Releases · GitLab.org / gitlab-runner · GitLab
August 13, 2026 - GitLab Runner is the open source project that is used to run your CI/CD jobs and send the results back to GitLab
Find elsewhere
🌐
GitLab
gitlab.com › gitlab.org › charts › gitlab runner › repository
CHANGELOG.md · main · GitLab.org / charts / GitLab Runner · GitLab
1 week ago - Fix the register-the-runner script !479 (merged) (Jeremy Huntwork @jhuntwork) Remove registration token integration test !477 (merged) ... Fix replicas value check for nil to work also with Terraform !478 (merged) (Sabyrzhan Tynybayev @sabyrzhan) Update list of rules to be added to the rbac role permissions as per documentation !471 (merged) (Ismael Posada Trobo @iposadat)
🌐
Reddit
reddit.com › r/gitlab › gitlab runner install & updates
r/gitlab on Reddit: Gitlab Runner Install & Updates
May 22, 2023 -

Hello, We host our products on AWS Cluster. We have multiple products and clusters that are deployed on their respective AWS Account that we "Switch Role" to. For each Group of Product we have multiple environments (DEV/UAT/PROD).

We create CFN stack for our Bastion host (Private Subnet) and from that Bastion Host we create another EC2 instance (Private Subnet) that acts as our GitLab Runner for the Group for a particular environment.

This way we are ending up with many Runners (custom and not shared).

Question:

I was wondering how to manage these runners if we have to push any changes to the runner's themselves (let's say install a software or patching etc) without manually logging into them individually or Creating them new from the Bastion.

We are open to adopting a different runner creation setup if this is not ideal.

Top answer
1 of 3
1
2 options off the top of my head AWS Systems Manager/ Patch Manager Opsworks I think Patch Manager will run the patching automatically based on a calendar you setup. I use Opsworks where I have a specific recipe that does the updates and reboots the instance. I tell the recipe to run and pick all the instances in the stack I want to have the command ran on.
2 of 3
1
As u/jwestbrook mentions, using AWS Systems Manager is one way you can manage the configuration of multiple systems and avoid the problem of managing these systems directly and individually. You can, for example, use Systems Manager to run ansible playbooks to reach a desired configuration (e.g., installing software packages) across many systems all at once via the Systems Manager agent -- no bastions needed. That said, I would suggest that you avoid this problem altogether in the first place by not fragmenting your runners into every network segment in which you need a runner to access. As you mention, this increases complexity of managing runners registrations, tags, etc. -- it also fragments your available resources, complicates access control, among other concerns. As a quick side note: I would also suggest use of container-based executors, like the docker executor. This way, you really don't have to worry about ensuring software is installed to begin with. You can just publish a docker image containing the required software and the runner can use new images without any configuration changes. Instead, it is ideal if you have a single unified pool of shared runners -- they can potentially be deployed in their own AWS account, just like any of your other 'products'. It may be helpful if you think of your runners as you would with gitlab.com shared runners. Every runner should be unprivileged by default (except perhaps to pull necessary docker images). How, exactly, you implement this depends on a lot of details, but the end goal is that every job is able to obtain appropriate (and temporary) access in a just-in-time manner and does not rely on the runner to gain any privileges -- just as you would do if your jobs ran on gitlab.com shared runners. One major part of implementing this is to use OIDC federation with GitLab and AWS to obtain access to IAM roles appropriately scoped for the project for each job that needs AWS access. That role can also have delegated permission in multiple AWS accounts, including assuming roles in different accounts, obtaining secrets, or whatever it needs to do.
🌐
GitLab
docs.gitlab.com › gitlab docs › administer › administer gitlab runner › register a runner › migrate to the new runner registration workflow
Migrating to the new runner registration workflow | GitLab Docs
Learn about the new GitLab Runner creation workflow that uses the runner authentication tokens instead of legacy registration tokens to improve CI/CD runner security.
🌐
GitLab
forum.gitlab.com › how to use gitlab › upgrade
Upgrade path for runner - Upgrade - GitLab Forum
July 8, 2022 - Although the documentation says (from Upgrading GitLab | GitLab) "it is very important to upgrade GitLab Runner to match the GitLab minor version that was upgraded to. ", our setup has worked fine with runners not being …
🌐
mixable Blog
mixable.blog › home › install and update gitlab runner
Install and update GitLab Runner | mixable Blog
May 3, 2024 - This post describes how to Install, update and register GitLab Runner on a Linux system using a Docker container.
🌐
DEV Community
dev.to › marocz › my-journey-upgrading-gitlab-and-gitlab-runner-on-aws-ec2-4anf
My Journey Upgrading GitLab and GitLab Runner on AWS EC2 - DEV Community
October 8, 2023 - curl -L https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.rpm.sh | sudo bash
🌐
GitLab
forum.gitlab.com › how to use gitlab › upgrade
Gitlab-runner --version still shows previous version after upgrade - Upgrade - GitLab Forum
March 18, 2024 - My organization upgraded our self-managed GitLab version (to GitLab Community Edition v16.9.2). So I was asked to upgrade the GitLab Runners of my team. I upgraded gitlab-runner from 15.0.0 to 19.6.9-1 on the machine where our runners are installed with: sudo apt-get update curl -L "https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.deb.sh" | sudo bash apt-cache madison gitlab-runner sudo apt-get install gitlab-runner=16.9.1-1 The upgrade completed successfully.
Top answer
1 of 8
17

Official answer for this problem (source of the text from the following link):

https://docs.gitlab.com/omnibus/update/package_signatures#update-keys-after-expiry-extension

Update keys after expiry extension

For Debian based distributions:

PackageCloud generally made use of apt-key, which will be deprecated in the future. Manually installed or configured repositories from some distributions are already using the signed-by support within Debian package source lists.

  1. Determine if you’re using apt-key or signed-by functionality:

     grep 'deb \[signed-by=' /etc/apt/sources.list.d/gitlab_gitlab-?e.list
    
  2. If this grep returns any lines, you're using signed-by functionality. This takes precedence over any apt-key usage. If this grep returns no lines, you're using apt-key functionality.

    For signed-by, the following script (run as root) updates the public keys for GitLab repositories:

    awk '/deb \[signed-by=/{
        pubkey = $2;
        sub(/\[signed-by=/, "", pubkey);
        sub(/\]$/, "", pubkey);
        print pubkey
      }' /etc/apt/sources.list.d/gitlab_gitlab-?e.list | \
    while read line; do
      curl -s "https://packages.gitlab.com/gpg.key" | gpg --dearmor > $line
    done
    
  3. For apt-key, the following script (run as root) updates the public keys for GitLab repositories:

    apt-key del 3F01618A51312F3F  
    curl -s "https://packages.gitlab.com/gpg.key" | apt-key add -
    apt-key list 3F01618A51312F3F
    
2 of 8
11

You can use the same step that is described in the installation script:

curl -fsSL "https://packages.gitlab.com/runner/gitlab-runner/gpgkey" | gpg --dearmor > /usr/share/keyrings/runner_gitlab-runner-archive-keyring.gpg

then

apt update

You can use the same to fix gitlab-ce and gitlab-ee

curl -fsSL "https://packages.gitlab.com/runner/gitlab-runner/gpgkey" | gpg --dearmor > /usr/share/keyrings/gitlab_gitlab-ee-archive-keyring.gpg
curl -fsSL "https://packages.gitlab.com/runner/gitlab-runner/gpgkey" | gpg --dearmor > /usr/share/keyrings/gitlab_gitlab-ce-archive-keyring.gpg
🌐
GitLab
docs.gitlab.com › gitlab docs › administer › administer gitlab runner › register a runner
Registering runners | GitLab Docs
Introduced in GitLab Runner 15.0, a change to the registration request format prevents the GitLab Runner from communicating with earlier versions of GitLab.
🌐
DevOps as Craft
virtualizare.net › devops › how-to-update-gitlab-runner-a-step-by-step-guide.html
How to Update GitLab Runner: A Step-by-Step Guide
March 28, 2024 - Locate your GitLab Runner’s configuration file, typically found at /etc/gitlab-runner/config.toml on Linux systems. Use the cp command to make a copy of the config.toml file and store it in a secure location. If you’re using a Docker executor, remember to also back up your Docker volumes and any associated data. Ensuring that you have a reliable backup allows you to approach the update with confidence, knowing that your configurations and data are safe.