diff --git a/nixos/modules/services/continuous-integration/github-runner.nix b/nixos/modules/services/continuous-integration/github-runner.nix
index a64d08c36cbb..19e73582a090 100644
--- a/nixos/modules/services/continuous-integration/github-runner.nix
+++ b/nixos/modules/services/continuous-integration/github-runner.nix
@@ -300,7 +300,6 @@ in
         UMask = "0066";
         ProtectProc = "invisible";
         SystemCallFilter = [
-          "~@capset"
           "~@clock"
           "~@cpu-emulation"
           "~@module"
@@ -308,6 +307,7 @@ in
           "~@obsolete"
           "~@raw-io"
           "~@reboot"
+          "~capset"
           "~setdomainname"
           "~sethostname"
         ];