diff --git a/cmd/ephemerd/run.go b/cmd/ephemerd/run.go
index e8fd85f..e81e9e2 100644
--- a/cmd/ephemerd/run.go
+++ b/cmd/ephemerd/run.go
@@ -131,9 +131,31 @@ func runWorkflow(ctx context.Context, workflowPath string, jobFilter string) err
 		return nil
 	}
 
+	// Use an isolated temp directory so the run command doesn't conflict with
+	// the ephemerd service (BoltDB is single-writer and they'd share the same
+	// data directory and named pipe otherwise).
+	tmpDir, err := os.MkdirTemp("", "ephemerd-run-*")
+	if err != nil {
+		return fmt.Errorf("creating temp directory: %w", err)
+	}
+	defer func() {
+		if err := os.RemoveAll(tmpDir); err != nil {
+			log.Warn("failed to clean up temp directory", "dir", tmpDir, "error", err)
+		}
+	}()
+
+	// On Windows, derive a unique named pipe so we don't collide with the
+	// service's \\.\pipe\ephemerd-containerd. On Unix the socket lives
+	// inside DataDir which is already unique.
+	var socketPath string
+	if runtime.GOOS == "windows" {
+		socketPath = `\\.\pipe\ephemerd-run-` + filepath.Base(tmpDir)
+	}
+
 	runner := &workflow.Runner{
-		DataDir: configDir,
-		Log:     log,
+		DataDir:    tmpDir,
+		SocketPath: socketPath,
+		Log:        log,
 	}
 
 	return runner.RunJob(ctx, jobName, job, repoDir)
diff --git a/pkg/workflow/runner.go b/pkg/workflow/runner.go
index a72f8aa..0fd8526 100644
--- a/pkg/workflow/runner.go
+++ b/pkg/workflow/runner.go
@@ -26,8 +26,9 @@ const (
 
 // Runner executes workflow jobs locally using embedded containerd.
 type Runner struct {
-	DataDir string
-	Log     *slog.Logger
+	DataDir    string
+	SocketPath string // optional: containerd socket override for isolation from the service
+	Log        *slog.Logger
 }
 
 // gitInfo holds repository metadata sniffed from the local git repo.
@@ -48,8 +49,9 @@ func (r *Runner) RunJob(ctx context.Context, jobName string, job Job, repoDir st
 	// Start embedded containerd
 	r.Log.Info("starting containerd")
 	ctrd, err := ctdpkg.New(ctdpkg.Config{
-		DataDir: r.DataDir,
-		Log:     r.Log,
+		DataDir:    r.DataDir,
+		SocketPath: r.SocketPath,
+		Log:        r.Log,
 	})
 	if err != nil {
 		return fmt.Errorf("starting containerd: %w", err)