I added and enabled a new role, but the runner isn't picking it up. Why, and what do I do?

QUESTION

I added and enabled a new role, but the runner isn't picking it up. Why, and what do I do?

ANSWER

New roles are only picked up on runner start

The runner loads its credentials when the runner process starts. If you add and enable a new role while the runner is already running, the runner keeps using the credentials it had at startup and does not automatically pick up the fresh creds tied to the newly enabled role.

Symptoms

- A deploy or operation fails with permission or credential errors even though the role you added has all the required permissions.

- The runner appears to be using stale or previous credentials instead of the role you just enabled.

How to fix it

- Add and enable the role as usual.

- Restart the runner process in the dashboard so it re-fetches credentials.

- Re-run the deploy or operation — it will now use the fresh creds from the newly enabled role.

Good to know

This is expected behavior today, since credentials are only refreshed when the runner starts. An improvement is under discussion to automatically trigger a runner restart when a role is enabled, which would remove this manual step.