diff --git a/act/container/docker_build.go b/act/container/docker_build.go
index b112466a..1efe797a 100644
--- a/act/container/docker_build.go
+++ b/act/container/docker_build.go
@@ -48,6 +48,7 @@ func NewDockerBuildExecutor(input NewDockerBuildExecutorInput) common.Executor {
 
 		options := client.ImageBuildOptions{
 			Tags:        []string{input.ImageTag},
+			Labels:      map[string]string{"com.gitea.runner.image": input.ImageTag}, // own image ID per tag, so removing one never deletes another job's identical build
 			Remove:      true,
 			AuthConfigs: LoadDockerAuthConfigs(ctx),
 			Dockerfile:  input.Dockerfile,
diff --git a/act/container/docker_build_test.go b/act/container/docker_build_test.go
index 39f27f55..2b71efe2 100644
--- a/act/container/docker_build_test.go
+++ b/act/container/docker_build_test.go
@@ -18,10 +18,12 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestDockerBuildReportsDaemonError(t *testing.T) {
+func TestDockerBuildLabelsImageWithItsTagAndReportsDaemonError(t *testing.T) {
+	var labels string
 	daemon := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
 		writer.Header().Set("API-Version", "1.47")
 		if strings.HasSuffix(request.URL.Path, "/build") {
+			labels = request.URL.Query().Get("labels")
 			writer.Header().Set("Content-Type", "application/json")
 			writer.WriteHeader(http.StatusInternalServerError)
 			_, _ = io.WriteString(writer, `{"message":"build rejected"}`)
@@ -35,6 +37,7 @@ func TestDockerBuildReportsDaemonError(t *testing.T) {
 	require.ErrorContains(t, NewDockerBuildExecutor(NewDockerBuildExecutorInput{
 		ImageTag: "action:test", Dockerfile: "Dockerfile", BuildContext: strings.NewReader(""),
 	})(t.Context()), "build rejected")
+	require.JSONEq(t, `{"com.gitea.runner.image":"action:test"}`, labels)
 }
 
 func TestCreateBuildContextFollowsDockerignoreAndSymlinkedRootButKeepsDockerfile(t *testing.T) {