diff --git a/kubernetes/dev/gitea/namespace.yaml b/kubernetes/dev/gitea/namespace.yaml
index 09a988f..cf1075e 100644
--- a/kubernetes/dev/gitea/namespace.yaml
+++ b/kubernetes/dev/gitea/namespace.yaml
@@ -2,3 +2,10 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: gitea
+  labels:
+    # The Gitea Actions runner uses a privileged Docker-in-Docker sidecar,
+    # which PodSecurity "baseline" forbids
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/enforce-version: latest
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged