diff --git a/models/user/user.go b/models/user/user.go
index f82acb61cb..3a5fc4ae68 100644
--- a/models/user/user.go
+++ b/models/user/user.go
@@ -675,6 +675,7 @@ func createUser(ctx context.Context, u *User, meta *Meta, createdByAdmin bool, o
 	u.Visibility = setting.Service.DefaultUserVisibilityMode
 	u.AllowCreateOrganization = setting.Service.DefaultAllowCreateOrganization && !setting.Admin.DisableRegularOrgCreation
 	u.AllowCreateDevcontainer = setting.Service.DefaultAllowCreateDevcontainer
+	u.AllowCreateActRunner = setting.Service.DefaultAllowCreateActRunner
 	u.EmailNotificationsPreference = setting.Admin.DefaultEmailNotification
 	u.MaxRepoCreation = -1
 	u.Theme = setting.UI.DefaultTheme
diff --git a/modules/setting/service.go b/modules/setting/service.go
index e31b1ff9dd..991f18e130 100644
--- a/modules/setting/service.go
+++ b/modules/setting/service.go
@@ -72,6 +72,7 @@ var Service = struct {
 	DefaultKeepEmailPrivate                 bool
 	DefaultAllowCreateOrganization          bool
 	DefaultAllowCreateDevcontainer          bool
+	DefaultAllowCreateActRunner             bool
 	DefaultUserIsRestricted                 bool
 	EnableTimetracking                      bool
 	DefaultEnableTimetracking               bool
@@ -207,6 +208,7 @@ func loadServiceFrom(rootCfg ConfigProvider) {
 	Service.DefaultKeepEmailPrivate = sec.Key("DEFAULT_KEEP_EMAIL_PRIVATE").MustBool()
 	Service.DefaultAllowCreateOrganization = sec.Key("DEFAULT_ALLOW_CREATE_ORGANIZATION").MustBool(true)
 	Service.DefaultAllowCreateDevcontainer = sec.Key("DEFAULT_ALLOW_CREATE_DEVCONTAINER").MustBool(true)
+	Service.DefaultAllowCreateActRunner = sec.Key("DEFAULT_ALLOW_CREATE_ACTRUNNER").MustBool(false)
 	Service.DefaultUserIsRestricted = sec.Key("DEFAULT_USER_IS_RESTRICTED").MustBool(false)
 	Service.EnableTimetracking = sec.Key("ENABLE_TIMETRACKING").MustBool(true)
 	if Service.EnableTimetracking {
diff --git a/routers/install/install.go b/routers/install/install.go
index 579238b1af..a7bf63f45d 100644
--- a/routers/install/install.go
+++ b/routers/install/install.go
@@ -156,6 +156,7 @@ func Install(ctx *context.Context) {
 	form.DefaultKeepEmailPrivate = setting.Service.DefaultKeepEmailPrivate
 	form.DefaultAllowCreateOrganization = setting.Service.DefaultAllowCreateOrganization
 	form.DefaultAllowCreateDevcontainer = setting.Service.DefaultAllowCreateDevcontainer
+	form.DefaultAllowCreateActRunner = setting.Service.DefaultAllowCreateActRunner
 	form.DefaultEnableTimetracking = setting.Service.DefaultEnableTimetracking
 	form.NoReplyAddress = setting.Service.NoReplyAddress
 	form.PasswordAlgorithm = hash.ConfigHashAlgorithm(setting.PasswordHashAlgo)
@@ -492,6 +493,7 @@ func SubmitInstall(ctx *context.Context) {
 	cfg.Section("service").Key("DEFAULT_KEEP_EMAIL_PRIVATE").SetValue(strconv.FormatBool(form.DefaultKeepEmailPrivate))
 	cfg.Section("service").Key("DEFAULT_ALLOW_CREATE_ORGANIZATION").SetValue(strconv.FormatBool(form.DefaultAllowCreateOrganization))
 	cfg.Section("service").Key("DEFAULT_ALLOW_CREATE_DEVCONTAINER").SetValue(strconv.FormatBool(form.DefaultAllowCreateDevcontainer))
+	cfg.Section("service").Key("DEFAULT_ALLOW_CREATE_ACTRUNNER").SetValue(strconv.FormatBool(form.DefaultAllowCreateActRunner))
 	cfg.Section("service").Key("DEFAULT_ENABLE_TIMETRACKING").SetValue(strconv.FormatBool(form.DefaultEnableTimetracking))
 	cfg.Section("service").Key("NO_REPLY_ADDRESS").SetValue(form.NoReplyAddress)
 	cfg.Section("cron.update_checker").Key("ENABLED").SetValue(strconv.FormatBool(form.EnableUpdateChecker))
diff --git a/services/forms/user_form.go b/services/forms/user_form.go
index 784a1b6a40..b48d9414e2 100644
--- a/services/forms/user_form.go
+++ b/services/forms/user_form.go
@@ -62,6 +62,7 @@ type InstallForm struct {
 	DefaultKeepEmailPrivate        bool
 	DefaultAllowCreateOrganization bool
 	DefaultAllowCreateDevcontainer bool
+	DefaultAllowCreateActRunner    bool
 	DefaultEnableTimetracking      bool
 	EnableUpdateChecker            bool
 	NoReplyAddress                 string
diff --git a/templates/admin/config.tmpl b/templates/admin/config.tmpl
index e18268f205..d6a801f388 100644
--- a/templates/admin/config.tmpl
+++ b/templates/admin/config.tmpl
@@ -155,6 +155,8 @@
 				<dd>{{svg (Iif .Service.DefaultAllowCreateOrganization "octicon-check" "octicon-x")}}</dd>
 				<dt>{{ctx.Locale.Tr "admin.config.default_allow_create_devcontainer"}}</dt>
 				<dd>{{svg (Iif .Service.DefaultAllowCreateDevcontainer "octicon-check" "octicon-x")}}</dd>
+				<dt>{{ctx.Locale.Tr "admin.config.default_allow_create_actrunner"}}</dt>
+				<dd>{{svg (Iif .Service.DefaultAllowCreateActRunner "octicon-check" "octicon-x")}}</dd>
 				<dt>{{ctx.Locale.Tr "admin.config.enable_timetracking"}}</dt>
 				<dd>{{svg (Iif .Service.EnableTimetracking "octicon-check" "octicon-x")}}</dd>
 				{{if .Service.EnableTimetracking}}
diff --git a/templates/admin/user/edit.tmpl b/templates/admin/user/edit.tmpl
index bf7fd6a680..75ab7eef1d 100644
--- a/templates/admin/user/edit.tmpl
+++ b/templates/admin/user/edit.tmpl
@@ -158,7 +158,7 @@
 				<div class="inline field">
 					<div class="ui checkbox">
 						<label><strong>{{ctx.Locale.Tr "admin.users.allow_create_actrunner"}}</strong></label>
-						<input name="allow_create_actrunner" type="checkbox" {{if or (.User.IsAdmin) (.User.AllowCreateActrunner)}}checked{{end}}>
+						<input name="allow_create_actrunner" type="checkbox" {{if .User.AllowCreateActRunner}}checked{{end}}>
 					</div>
 				</div>
 
diff --git a/templates/shared/actions/runner_list.tmpl b/templates/shared/actions/runner_list.tmpl
index 2d0a504a16..968c8ef052 100644
--- a/templates/shared/actions/runner_list.tmpl
+++ b/templates/shared/actions/runner_list.tmpl
@@ -9,15 +9,7 @@
 					{{svg "octicon-triangle-down" 14 "dropdown icon"}}
 				</button>
 				<div class="menu">
-					<div style="color: red; border: 1px solid red; padding: 10px; margin: 10px 0;">
-    <h4>权限调试信息：</h4>
-    <div>当前用户: {{if .Doer}}{{.Doer.Name}}{{else}}未登录{{end}}</div>
-    <div>AllowCreateActRunner: {{.AllowCreateActRunner}}</div>
-    <div>Permission.IsAdmin: {{.Permission.IsAdmin}}</div>
-    <div>or条件结果: {{or .AllowCreateActRunner .Permission.IsAdmin}}</div>
-    <div>Doer对象: {{printf "%+v" .Doer}}</div>
-</div>
-					{{if (.Permission.IsAdmin)}}
+					{{if or (.AllowCreateActRunner) (.Permission.IsAdmin)}}
 					<div class="item">
 						<a href="{{$.Link}}/regist_runner">{{ctx.Locale.Tr "actions.runners.regist_runner"}}</a>
 					</div>