How to Use Just-in-Time (JIT) Runners in GitHub Actions

A JIT runner is configured from a one-time encoded config, so it is inherently ephemeral and never re-registers.

Call the generate-jitconfig REST endpoint to mint an encoded config for a single ephemeral runner, then start the runner with --jitconfig. The runner runs one job and disappears, and no long-lived registration token sits on the host.

Steps

• POST to /repos/{owner}/{repo}/actions/runners/generate-jitconfig (or the org endpoint) with a name, runner group, and labels.
• Read the base64 encoded_jit_config from the response.
• Launch the runner with ./run.sh --jitconfig "$ENCODED"; it is ephemeral by definition.

Mint and start

ENCODED=$(gh api \
  -X POST /repos/my-org/my-repo/actions/runners/generate-jitconfig \
  -f name='jit-runner-1' \
  -F runner_group_id=1 \
  -f 'labels[]=self-hosted' \
  --jq '.encoded_jit_config')

./run.sh --jitconfig "$ENCODED"

Gotchas

• The encoded config is single-use; generate a new one for every runner you launch.
• JIT runners are always ephemeral, so you cannot reuse the same config across jobs.

Related guides