diff --git a/apps/base/iuclabs-runners/kustomization.yaml b/apps/base/iuclabs-runners/kustomization.yaml
index 8d0cf12..71de007 100644
--- a/apps/base/iuclabs-runners/kustomization.yaml
+++ b/apps/base/iuclabs-runners/kustomization.yaml
@@ -7,6 +7,9 @@ resources:
   - vaultauth.yaml
   - vaultstaticsecret.yaml
   - networkpolicy.yaml
+  - rbac.yaml
+  - scaleset-iuclabs-k8s.yaml
+  - networkpolicy-iuclabs-k8s.yaml
 
 generatorOptions:
   disableNameSuffixHash: true
diff --git a/apps/base/iuclabs-runners/rbac.yaml b/apps/base/iuclabs-runners/rbac.yaml
new file mode 100644
index 0000000..41fb92b
--- /dev/null
+++ b/apps/base/iuclabs-runners/rbac.yaml
@@ -0,0 +1,44 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: runner
+  namespace: iuclabs-runners
+automountServiceAccountToken: false
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: arc-manager
+  namespace: iuclabs-runners
+  finalizers:
+    - actions.github.com/cleanup-protection
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["create", "delete", "get"]
+  - apiGroups: [""]
+    resources: ["pods/status"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["secrets", "serviceaccounts"]
+    verbs: ["create", "delete", "get", "list", "patch", "update"]
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources: ["roles", "rolebindings"]
+    verbs: ["create", "delete", "get", "patch", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: arc-manager
+  namespace: iuclabs-runners
+  finalizers:
+    - actions.github.com/cleanup-protection
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: arc-manager
+subjects:
+  - kind: ServiceAccount
+    name: arc-gha-rs-controller
+    namespace: arc-system
diff --git a/apps/base/iuclabs-runners/scaleset-iuclabs-k8s.yaml b/apps/base/iuclabs-runners/scaleset-iuclabs-k8s.yaml
new file mode 100644
index 0000000..8931ff1
--- /dev/null
+++ b/apps/base/iuclabs-runners/scaleset-iuclabs-k8s.yaml
@@ -0,0 +1,66 @@
+---
+apiVersion: actions.github.com/v1alpha1
+kind: AutoscalingRunnerSet
+metadata:
+  name: iuclabs-k8s
+  namespace: iuclabs-runners
+  labels:
+    app.kubernetes.io/version: "0.15.1"
+  annotations:
+    actions.github.com/cleanup-manager-role-name: arc-manager
+    actions.github.com/cleanup-manager-role-binding: arc-manager
+spec:
+  githubConfigUrl: https://github.com/IUCLabs
+  githubConfigSecret: github-app
+  runnerScaleSetName: iuclabs-k8s
+  minRunners: 0
+  maxRunners: 4
+  template:
+    metadata:
+      labels:
+        runners.unkin.net/scale-set: iuclabs-k8s
+    spec:
+      serviceAccountName: runner
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1001
+        runAsGroup: 1001
+        seccompProfile:
+          type: RuntimeDefault
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              runners.unkin.net/scale-set: iuclabs-k8s
+      containers:
+        - name: runner
+          image: ghcr.io/actions/actions-runner:2.338.2
+          command: ["/home/runner/run.sh"]
+          env:
+            - name: ACTIONS_RUNNER_HOOK_JOB_STARTED
+              value: /hooks/job-started.sh
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 1
+              memory: 512Mi
+            limits:
+              cpu: 2
+              memory: 2Gi
+          volumeMounts:
+            - name: hooks
+              mountPath: /hooks
+              readOnly: true
+      volumes:
+        - name: hooks
+          configMap:
+            name: runner-hooks
+            defaultMode: 0555
diff --git a/apps/overlays/au-syd1/iuclabs-runners/kustomization.yaml b/apps/overlays/au-syd1/iuclabs-runners/kustomization.yaml
index c35c13f..1d66974 100644
--- a/apps/overlays/au-syd1/iuclabs-runners/kustomization.yaml
+++ b/apps/overlays/au-syd1/iuclabs-runners/kustomization.yaml
@@ -4,11 +4,3 @@ kind: Kustomization
 
 resources:
   - ../../../base/iuclabs-runners
-
-helmCharts:
-  - name: gha-runner-scale-set
-    repo: oci://ghcr.io/actions/actions-runner-controller-charts
-    version: "0.15.1"
-    releaseName: iuclabs
-    namespace: iuclabs-runners
-    valuesFile: values.yaml
diff --git a/apps/overlays/au-syd1/iuclabs-runners/values.yaml b/apps/overlays/au-syd1/iuclabs-runners/values.yaml
deleted file mode 100644
index c42f765..0000000
--- a/apps/overlays/au-syd1/iuclabs-runners/values.yaml
+++ /dev/null
@@ -1,55 +0,0 @@
----
-githubConfigUrl: https://github.com/IUCLabs
-githubConfigSecret: github-app
-runnerScaleSetName: iuclabs-k8s
-minRunners: 0
-maxRunners: 4
-
-controllerServiceAccount:
-  namespace: arc-system
-  name: arc-gha-rs-controller
-
-template:
-  spec:
-    automountServiceAccountToken: false
-    securityContext:
-      runAsNonRoot: true
-      runAsUser: 1001
-      runAsGroup: 1001
-      seccompProfile:
-        type: RuntimeDefault
-    topologySpreadConstraints:
-      - maxSkew: 1
-        topologyKey: kubernetes.io/hostname
-        whenUnsatisfiable: ScheduleAnyway
-        labelSelector:
-          matchLabels:
-            actions.github.com/scale-set-name: iuclabs-k8s
-    containers:
-      - name: runner
-        image: ghcr.io/actions/actions-runner:2.338.2
-        command: ["/home/runner/run.sh"]
-        env:
-          - name: ACTIONS_RUNNER_HOOK_JOB_STARTED
-            value: /hooks/job-started.sh
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-              - ALL
-        resources:
-          requests:
-            cpu: 1
-            memory: 512Mi
-          limits:
-            cpu: 2
-            memory: 2Gi
-        volumeMounts:
-          - name: hooks
-            mountPath: /hooks
-            readOnly: true
-    volumes:
-      - name: hooks
-        configMap:
-          name: runner-hooks
-          defaultMode: 0555
diff --git a/argocd/projects/platform.yaml b/argocd/projects/platform.yaml
index 8140509..47a5abd 100644
--- a/argocd/projects/platform.yaml
+++ b/argocd/projects/platform.yaml
@@ -15,7 +15,6 @@ spec:
     - oci://ghcr.io/netbox-community/netbox-chart/netbox
     - oci://docker.gitea.com/charts
     - oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller
-    - oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set
   destinations:
     - namespace: '*-system'
       server: https://kubernetes.default.svc