diff --git a/ansible/roles/gitea-runner/molecule/deregister/converge.yml b/ansible/roles/gitea-runner/molecule/deregister/converge.yml
new file mode 100644
index 0000000..4d38b64
--- /dev/null
+++ b/ansible/roles/gitea-runner/molecule/deregister/converge.yml
@@ -0,0 +1,11 @@
+---
+- name: Converge
+  hosts: all
+  become: true
+  vars:
+    gitea_url: "http://localhost:3000"
+    registration_token: "fake-token-for-testing"
+    runner_name: "deregister-test-runner"
+    skip_runner_registration: true
+  roles:
+    - role: gitea-runner
diff --git a/ansible/roles/gitea-runner/molecule/deregister/molecule.yml b/ansible/roles/gitea-runner/molecule/deregister/molecule.yml
new file mode 100644
index 0000000..6a9a213
--- /dev/null
+++ b/ansible/roles/gitea-runner/molecule/deregister/molecule.yml
@@ -0,0 +1,40 @@
+---
+driver:
+  name: docker
+
+platforms:
+  - name: ${MOLECULE_PLATFORM_NAME:-ubuntu-2204}
+    image: ${MOLECULE_PLATFORM_IMAGE:-geerlingguy/docker-ubuntu2204-ansible:latest}
+    command: ${MOLECULE_PLATFORM_COMMAND:-sleep infinity}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+    pre_build_image: true
+
+provisioner:
+  name: ansible
+  playbooks:
+    converge: converge.yml
+    prepare: ../common/prepare.yml
+    side_effect: side_effect.yml
+  env:
+    ANSIBLE_ROLES_PATH: "../../.."
+
+scenario:
+  test_sequence:
+    - dependency
+    - cleanup
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - side_effect
+    - verify
+    - cleanup
+    - destroy
+
+verifier:
+  name: ansible
diff --git a/ansible/roles/gitea-runner/molecule/deregister/side_effect.yml b/ansible/roles/gitea-runner/molecule/deregister/side_effect.yml
new file mode 100644
index 0000000..305cfe0
--- /dev/null
+++ b/ansible/roles/gitea-runner/molecule/deregister/side_effect.yml
@@ -0,0 +1,28 @@
+---
+- name: Create fake runner registration file
+  hosts: all
+  become: true
+  vars:
+    runner_name: "deregister-test-runner"
+  tasks:
+    - name: Ensure fake .runner file exists
+      ansible.builtin.copy:
+        dest: "/var/lib/gitea-runner/{{ runner_name }}/.runner"
+        content: |
+          {"id": 1, "uuid": "test-uuid-1234", "name": "{{ runner_name }}", "address": "http://localhost:3000"}
+        mode: "0644"
+
+- name: Deregister runner
+  hosts: all
+  become: true
+  vars:
+    runner_name: "deregister-test-runner"
+    registration_token: "fake-token-for-testing"
+    gitea_url: "http://localhost:3000"
+    runner_mode: "docker"
+    skip_runner_registration: false
+  tasks:
+    - name: Include deregistration tasks
+      ansible.builtin.include_role:
+        name: gitea-runner
+        tasks_from: deregister.yml
diff --git a/ansible/roles/gitea-runner/molecule/deregister/verify.yml b/ansible/roles/gitea-runner/molecule/deregister/verify.yml
new file mode 100644
index 0000000..1339389
--- /dev/null
+++ b/ansible/roles/gitea-runner/molecule/deregister/verify.yml
@@ -0,0 +1,30 @@
+---
+- name: Verify
+  hosts: all
+  become: true
+  pre_tasks:
+    - name: Load role defaults
+      ansible.builtin.include_vars:
+        dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults"
+  tasks:
+    - name: Check registration file was removed
+      ansible.builtin.stat:
+        path: "/var/lib/gitea-runner/deregister-test-runner/.runner"
+      register: runner_file_stat
+
+    - name: Assert registration file no longer exists
+      ansible.builtin.assert:
+        that:
+          - not runner_file_stat.stat.exists
+        fail_msg: "Registration file (.runner) was not removed by deregistration"
+
+    - name: Check systemd template still exists
+      ansible.builtin.stat:
+        path: "/etc/systemd/system/gitea-runner@.service"
+      register: service_stat
+
+    - name: Assert systemd template still exists after deregister
+      ansible.builtin.assert:
+        that:
+          - service_stat.stat.exists
+        fail_msg: "Systemd template unit was incorrectly removed"
diff --git a/ansible/roles/gitea-runner/molecule/template-content/converge.yml b/ansible/roles/gitea-runner/molecule/template-content/converge.yml
new file mode 100644
index 0000000..2b9106a
--- /dev/null
+++ b/ansible/roles/gitea-runner/molecule/template-content/converge.yml
@@ -0,0 +1,23 @@
+---
+- name: Converge Docker mode
+  hosts: all
+  become: true
+  vars:
+    gitea_url: "http://localhost:3000"
+    registration_token: "fake-token-for-testing"
+    runner_name: "template-docker-runner"
+    skip_runner_registration: true
+  roles:
+    - role: gitea-runner
+
+- name: Converge Binary mode
+  hosts: all
+  become: true
+  vars:
+    gitea_url: "http://localhost:3000"
+    registration_token: "fake-token-for-testing"
+    runner_name: "template-binary-runner"
+    runner_mode: "binary"
+    skip_runner_registration: true
+  roles:
+    - role: gitea-runner
diff --git a/ansible/roles/gitea-runner/molecule/template-content/molecule.yml b/ansible/roles/gitea-runner/molecule/template-content/molecule.yml
new file mode 100644
index 0000000..56c6310
--- /dev/null
+++ b/ansible/roles/gitea-runner/molecule/template-content/molecule.yml
@@ -0,0 +1,39 @@
+---
+driver:
+  name: docker
+
+platforms:
+  - name: ${MOLECULE_PLATFORM_NAME:-ubuntu-2204}
+    image: ${MOLECULE_PLATFORM_IMAGE:-geerlingguy/docker-ubuntu2204-ansible:latest}
+    command: ${MOLECULE_PLATFORM_COMMAND:-sleep infinity}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+    pre_build_image: true
+
+provisioner:
+  name: ansible
+  playbooks:
+    converge: converge.yml
+    prepare: ../common/prepare.yml
+  env:
+    ANSIBLE_ROLES_PATH: "../../.."
+
+scenario:
+  test_sequence:
+    - dependency
+    - cleanup
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - side_effect
+    - verify
+    - cleanup
+    - destroy
+
+verifier:
+  name: ansible
diff --git a/ansible/roles/gitea-runner/molecule/template-content/verify.yml b/ansible/roles/gitea-runner/molecule/template-content/verify.yml
new file mode 100644
index 0000000..de961ea
--- /dev/null
+++ b/ansible/roles/gitea-runner/molecule/template-content/verify.yml
@@ -0,0 +1,50 @@
+---
+- name: Verify
+  hosts: all
+  become: true
+  pre_tasks:
+    - name: Load role defaults
+      ansible.builtin.include_vars:
+        dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults"
+  tasks:
+    - name: Read rendered Docker systemd template
+      ansible.builtin.slurp:
+        src: "/etc/systemd/system/gitea-runner@.service"
+      register: docker_template
+
+    - name: Assert Docker mode template contains expected directives
+      ansible.builtin.assert:
+        that:
+          - "'Type=oneshot' in docker_template.content | b64decode"
+          - "'RemainAfterExit=yes' in docker_template.content | b64decode"
+          - "'Requires=docker.service' in docker_template.content | b64decode"
+          - "'docker run -d' in docker_template.content | b64decode"
+          - "'ExecStop=/usr/bin/docker stop' in docker_template.content | b64decode"
+          - "'Restart=on-failure' in docker_template.content | b64decode"
+        fail_msg: "Docker systemd template is missing expected directives"
+
+    - name: Read rendered prune service template
+      ansible.builtin.slurp:
+        src: "/etc/systemd/system/docker-prune.service"
+      register: prune_service
+
+    - name: Assert prune service contains expected directives
+      ansible.builtin.assert:
+        that:
+          - "'Type=oneshot' in prune_service.content | b64decode"
+          - "'docker system prune' in prune_service.content | b64decode"
+          - "'docker volume prune' in prune_service.content | b64decode"
+          - "'label=gitea-runner=true' in prune_service.content | b64decode"
+        fail_msg: "Prune service template is missing expected directives"
+
+    - name: Read rendered prune timer template
+      ansible.builtin.slurp:
+        src: "/etc/systemd/system/docker-prune.timer"
+      register: prune_timer
+
+    - name: Assert prune timer contains expected directives
+      ansible.builtin.assert:
+        that:
+          - "'OnCalendar=daily' in prune_timer.content | b64decode"
+          - "'Persistent=true' in prune_timer.content | b64decode"
+        fail_msg: "Prune timer template is missing expected directives"
diff --git a/ansible/roles/gitea-runner/molecule/update/converge.yml b/ansible/roles/gitea-runner/molecule/update/converge.yml
new file mode 100644
index 0000000..815e51c
--- /dev/null
+++ b/ansible/roles/gitea-runner/molecule/update/converge.yml
@@ -0,0 +1,23 @@
+---
+- name: Converge Docker mode
+  hosts: all
+  become: true
+  vars:
+    gitea_url: "http://localhost:3000"
+    registration_token: "fake-token-for-testing"
+    runner_name: "update-docker-runner"
+    skip_runner_registration: true
+  roles:
+    - role: gitea-runner
+
+- name: Converge Binary mode
+  hosts: all
+  become: true
+  vars:
+    gitea_url: "http://localhost:3000"
+    registration_token: "fake-token-for-testing"
+    runner_name: "update-binary-runner"
+    runner_mode: "binary"
+    skip_runner_registration: true
+  roles:
+    - role: gitea-runner
diff --git a/ansible/roles/gitea-runner/molecule/update/molecule.yml b/ansible/roles/gitea-runner/molecule/update/molecule.yml
new file mode 100644
index 0000000..6a9a213
--- /dev/null
+++ b/ansible/roles/gitea-runner/molecule/update/molecule.yml
@@ -0,0 +1,40 @@
+---
+driver:
+  name: docker
+
+platforms:
+  - name: ${MOLECULE_PLATFORM_NAME:-ubuntu-2204}
+    image: ${MOLECULE_PLATFORM_IMAGE:-geerlingguy/docker-ubuntu2204-ansible:latest}
+    command: ${MOLECULE_PLATFORM_COMMAND:-sleep infinity}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+    pre_build_image: true
+
+provisioner:
+  name: ansible
+  playbooks:
+    converge: converge.yml
+    prepare: ../common/prepare.yml
+    side_effect: side_effect.yml
+  env:
+    ANSIBLE_ROLES_PATH: "../../.."
+
+scenario:
+  test_sequence:
+    - dependency
+    - cleanup
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - side_effect
+    - verify
+    - cleanup
+    - destroy
+
+verifier:
+  name: ansible
diff --git a/ansible/roles/gitea-runner/molecule/update/side_effect.yml b/ansible/roles/gitea-runner/molecule/update/side_effect.yml
new file mode 100644
index 0000000..e1b44f9
--- /dev/null
+++ b/ansible/roles/gitea-runner/molecule/update/side_effect.yml
@@ -0,0 +1,24 @@
+---
+- name: Update Docker mode runner
+  hosts: all
+  become: true
+  vars:
+    runner_name: "update-docker-runner"
+    runner_mode: "docker"
+  tasks:
+    - name: Include Docker update tasks
+      ansible.builtin.include_role:
+        name: gitea-runner
+        tasks_from: docker_update.yml
+
+- name: Update Binary mode runner
+  hosts: all
+  become: true
+  vars:
+    runner_name: "update-binary-runner"
+    runner_mode: "binary"
+  tasks:
+    - name: Include binary update tasks
+      ansible.builtin.include_role:
+        name: gitea-runner
+        tasks_from: binary_update.yml
diff --git a/ansible/roles/gitea-runner/molecule/update/verify.yml b/ansible/roles/gitea-runner/molecule/update/verify.yml
new file mode 100644
index 0000000..44ef8b8
--- /dev/null
+++ b/ansible/roles/gitea-runner/molecule/update/verify.yml
@@ -0,0 +1,63 @@
+---
+- name: Verify
+  hosts: all
+  become: true
+  pre_tasks:
+    - name: Load role defaults
+      ansible.builtin.include_vars:
+        dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults"
+  tasks:
+    - name: Check Docker runner image still exists after update
+      ansible.builtin.command: docker images gitea/runner --format '{{ '{{' }} .Repository {{ '}}' }}:{{ '{{' }} .Tag {{ '}}' }}'
+      register: image_list
+      changed_when: false
+
+    - name: Assert runner image exists after update
+      ansible.builtin.assert:
+        that:
+          - "'gitea/runner' in image_list.stdout"
+        fail_msg: "Runner Docker image missing after update"
+
+    - name: Check binary runner executable still exists after update
+      ansible.builtin.stat:
+        path: "{{ gitea_runner_binary_path }}"
+      register: binary_stat
+
+    - name: Assert binary executable exists after update
+      ansible.builtin.assert:
+        that:
+          - binary_stat.stat.exists
+        fail_msg: "Binary runner executable missing after update"
+
+    - name: Check systemd template still exists
+      ansible.builtin.stat:
+        path: "/etc/systemd/system/gitea-runner@.service"
+      register: service_stat
+
+    - name: Assert systemd template still exists after update
+      ansible.builtin.assert:
+        that:
+          - service_stat.stat.exists
+        fail_msg: "Systemd template unit missing after update"
+
+    - name: Check Docker mode data directory still exists
+      ansible.builtin.stat:
+        path: "/var/lib/gitea-runner/update-docker-runner"
+      register: docker_data_stat
+
+    - name: Assert Docker mode data directory exists after update
+      ansible.builtin.assert:
+        that:
+          - docker_data_stat.stat.exists
+        fail_msg: "Docker runner data directory missing after update"
+
+    - name: Check Binary mode data directory still exists
+      ansible.builtin.stat:
+        path: "/var/lib/gitea-runner/update-binary-runner"
+      register: binary_data_stat
+
+    - name: Assert Binary mode data directory exists after update
+      ansible.builtin.assert:
+        that:
+          - binary_data_stat.stat.exists
+        fail_msg: "Binary runner data directory missing after update"