diff --git a/pkg/container/docker_run_test.go b/pkg/container/docker_run_test.go
index d05e9c34..4b4b7005 100644
--- a/pkg/container/docker_run_test.go
+++ b/pkg/container/docker_run_test.go
@@ -14,10 +14,12 @@ import (
 	"github.com/nektos/act/pkg/common"
 
 	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/api/types/mount"
 	"github.com/moby/moby/client"
 	"github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
 )
 
 func TestDocker(t *testing.T) {
@@ -326,3 +328,31 @@ func TestCheckVolumes(t *testing.T) {
 		})
 	}
 }
+
+func TestOptionsMountSurvivesSanitize(t *testing.T) {
+	logger, _ := test.NewNullLogger()
+	ctx := common.WithLogger(context.Background(), logger)
+
+	source := "/etc/ssl/certs/ca-certificates.crt"
+	cr := &containerReference{
+		input: &NewContainerInput{
+			Options:      fmt.Sprintf("--mount type=bind,source=%s,target=%s,readonly", source, source),
+			NetworkMode:  "container:job",
+			ValidVolumes: []string{source},
+		},
+	}
+
+	config, hostConfig, err := cr.mergeContainerConfigs(ctx, &container.Config{}, &container.HostConfig{})
+	require.NoError(t, err)
+
+	_, hostConfig = cr.sanitizeConfig(ctx, config, hostConfig)
+
+	assert.Len(t, hostConfig.Mounts, 1)
+	if len(hostConfig.Mounts) == 1 {
+		m := hostConfig.Mounts[0]
+		assert.Equal(t, mount.TypeBind, m.Type)
+		assert.Equal(t, source, m.Source)
+		assert.Equal(t, source, m.Target)
+		assert.True(t, m.ReadOnly)
+	}
+}
diff --git a/pkg/runner/step_docker.go b/pkg/runner/step_docker.go
index 2f239866..fddc316c 100644
--- a/pkg/runner/step_docker.go
+++ b/pkg/runner/step_docker.go
@@ -130,6 +130,7 @@ func (sd *stepDocker) newStepContainer(ctx context.Context, image string, cmd []
 		Privileged:   rc.Config.Privileged,
 		UsernsMode:   rc.Config.UsernsMode,
 		Platform:     rc.Config.ContainerArchitecture,
+		Options:      rc.Config.ContainerOptions,
 		AutoRemove:   rc.Config.AutoRemove,
 		ValidVolumes: rc.Config.ValidVolumes,
 	})
diff --git a/pkg/runner/step_docker_test.go b/pkg/runner/step_docker_test.go
index 3d90ac34..de04da03 100644
--- a/pkg/runner/step_docker_test.go
+++ b/pkg/runner/step_docker_test.go
@@ -32,7 +32,9 @@ func TestStepDockerMain(t *testing.T) {
 	sd := &stepDocker{
 		RunContext: &RunContext{
 			StepResults: map[string]*model.StepResult{},
-			Config:      &Config{},
+			Config: &Config{
+				ContainerOptions: "--mount type=bind,source=/etc/ssl/certs/ca-certificates.crt,target=/etc/ssl/certs/ca-certificates.crt,readonly",
+			},
 			Run: &model.Run{
 				JobID: "1",
 				Workflow: &model.Workflow{
@@ -99,6 +101,7 @@ func TestStepDockerMain(t *testing.T) {
 	assert.Nil(t, err)
 
 	assert.Equal(t, "node:14", input.Image)
+	assert.Equal(t, sd.RunContext.Config.ContainerOptions, input.Options)
 
 	cm.AssertExpectations(t)
 }