diff --git a/images/linux-al2023/github_agent.linux.pkr.hcl b/images/linux-al2023/github_agent.linux.pkr.hcl
index ac8c4dff40..93552bbd0b 100644
--- a/images/linux-al2023/github_agent.linux.pkr.hcl
+++ b/images/linux-al2023/github_agent.linux.pkr.hcl
@@ -42,6 +42,12 @@ variable "instance_type" {
   default     = "m3.medium"
 }
 
+variable "iam_instance_profile" {
+  description = "IAM instance profile Packer will use for the builder. An empty string (default) means no profile will be assigned."
+  type        = string
+  default     = ""
+}
+
 variable "root_volume_size_gb" {
   type    = number
   default = 8
@@ -77,6 +83,12 @@ variable "custom_shell_commands" {
   default     = []
 }
 
+variable "custom_shell_commands_post_runner_install" {
+  description = "Additional commands to run on the EC2 instance, to customize the instance, like installing packages. This runs after the agent is installed."
+  type        = list(string)
+  default     = []
+}
+
 variable "temporary_security_group_source_public_ip" {
   description = "When enabled, use public IP of the host (obtained from https://checkip.amazonaws.com) as CIDR block to be authorized access to the instance, when packer is creating a temporary security group. Note: If you specify `security_group_id` then this input is ignored."
   type        = bool
@@ -98,6 +110,7 @@ locals {
 source "amazon-ebs" "githubrunner" {
   ami_name                                  = "github-runner-al2023-x86_64-${formatdate("YYYYMMDDhhmm", timestamp())}"
   instance_type                             = var.instance_type
+  iam_instance_profile                      = var.iam_instance_profile
   region                                    = var.region
   security_group_id                         = var.security_group_id
   subnet_id                                 = var.subnet_id
@@ -190,6 +203,11 @@ build {
     ]
   }
 
+  provisioner "shell" {
+    environment_vars = []
+    inline           = concat(var.custom_shell_commands_post_runner_install)
+  }
+
   post-processor "manifest" {
     output     = "manifest.json"
     strip_path = true
diff --git a/images/ubuntu-focal/github_agent.ubuntu.pkr.hcl b/images/ubuntu-focal/github_agent.ubuntu.pkr.hcl
index 56cb65ee5b..ac303d55fc 100644
--- a/images/ubuntu-focal/github_agent.ubuntu.pkr.hcl
+++ b/images/ubuntu-focal/github_agent.ubuntu.pkr.hcl
@@ -42,6 +42,12 @@ variable "instance_type" {
   default     = "t3.medium"
 }
 
+variable "iam_instance_profile" {
+  description = "IAM instance profile Packer will use for the builder. An empty string (default) means no profile will be assigned."
+  type        = string
+  default     = ""
+}
+
 variable "root_volume_size_gb" {
   type    = number
   default = 8
@@ -77,6 +83,12 @@ variable "custom_shell_commands" {
   default     = []
 }
 
+variable "custom_shell_commands_post_runner_install" {
+  description = "Additional commands to run on the EC2 instance, to customize the instance, like installing packages. This runs after the agent is installed."
+  type        = list(string)
+  default     = []
+}
+
 variable "temporary_security_group_source_public_ip" {
   description = "When enabled, use public IP of the host (obtained from https://checkip.amazonaws.com) as CIDR block to be authorized access to the instance, when packer is creating a temporary security group. Note: If you specify `security_group_id` then this input is ignored."
   type        = bool
@@ -98,6 +110,7 @@ locals {
 source "amazon-ebs" "githubrunner" {
   ami_name                                  = "github-runner-ubuntu-focal-amd64-${formatdate("YYYYMMDDhhmm", timestamp())}"
   instance_type                             = var.instance_type
+  iam_instance_profile                      = var.iam_instance_profile
   region                                    = var.region
   security_group_id                         = var.security_group_id
   subnet_id                                 = var.subnet_id
@@ -200,6 +213,12 @@ build {
       "sudo chmod +x /var/lib/cloud/scripts/per-boot/start-runner.sh",
     ]
   }
+
+  provisioner "shell" {
+    environment_vars = []
+    inline           = concat(var.custom_shell_commands_post_runner_install)
+  }
+
   post-processor "manifest" {
     output     = "manifest.json"
     strip_path = true
diff --git a/images/ubuntu-jammy-arm64/github_agent.ubuntu.pkr.hcl b/images/ubuntu-jammy-arm64/github_agent.ubuntu.pkr.hcl
index 91e2d7f38e..0baa59b420 100644
--- a/images/ubuntu-jammy-arm64/github_agent.ubuntu.pkr.hcl
+++ b/images/ubuntu-jammy-arm64/github_agent.ubuntu.pkr.hcl
@@ -42,6 +42,12 @@ variable "instance_type" {
   default     = "t4g.small"
 }
 
+variable "iam_instance_profile" {
+  description = "IAM instance profile Packer will use for the builder. An empty string (default) means no profile will be assigned."
+  type        = string
+  default     = ""
+}
+
 variable "root_volume_size_gb" {
   type    = number
   default = 8
@@ -77,6 +83,12 @@ variable "custom_shell_commands" {
   default     = []
 }
 
+variable "custom_shell_commands_post_runner_install" {
+  description = "Additional commands to run on the EC2 instance, to customize the instance, like installing packages. This runs after the agent is installed."
+  type        = list(string)
+  default     = []
+}
+
 variable "temporary_security_group_source_public_ip" {
   description = "When enabled, use public IP of the host (obtained from https://checkip.amazonaws.com) as CIDR block to be authorized access to the instance, when packer is creating a temporary security group. Note: If you specify `security_group_id` then this input is ignored."
   type        = bool
@@ -98,6 +110,7 @@ locals {
 source "amazon-ebs" "githubrunner" {
   ami_name                                  = "github-runner-ubuntu-jammy-arm64-${formatdate("YYYYMMDDhhmm", timestamp())}"
   instance_type                             = var.instance_type
+  iam_instance_profile                      = var.iam_instance_profile
   region                                    = var.region
   security_group_id                         = var.security_group_id
   subnet_id                                 = var.subnet_id
@@ -200,6 +213,12 @@ build {
       "sudo chmod +x /var/lib/cloud/scripts/per-boot/start-runner.sh",
     ]
   }
+
+  provisioner "shell" {
+    environment_vars = []
+    inline           = concat(var.custom_shell_commands_post_runner_install)
+  }
+
   post-processor "manifest" {
     output     = "manifest.json"
     strip_path = true
diff --git a/images/ubuntu-jammy/github_agent.ubuntu.pkr.hcl b/images/ubuntu-jammy/github_agent.ubuntu.pkr.hcl
index 311bbc5b22..97050d204f 100644
--- a/images/ubuntu-jammy/github_agent.ubuntu.pkr.hcl
+++ b/images/ubuntu-jammy/github_agent.ubuntu.pkr.hcl
@@ -42,6 +42,12 @@ variable "instance_type" {
   default     = "t3.medium"
 }
 
+variable "iam_instance_profile" {
+  description = "IAM instance profile Packer will use for the builder. An empty string (default) means no profile will be assigned."
+  type        = string
+  default     = ""
+}
+
 variable "root_volume_size_gb" {
   type    = number
   default = 8
@@ -77,6 +83,12 @@ variable "custom_shell_commands" {
   default     = []
 }
 
+variable "custom_shell_commands_post_runner_install" {
+  description = "Additional commands to run on the EC2 instance, to customize the instance, like installing packages. This runs after the agent is installed."
+  type        = list(string)
+  default     = []
+}
+
 variable "temporary_security_group_source_public_ip" {
   description = "When enabled, use public IP of the host (obtained from https://checkip.amazonaws.com) as CIDR block to be authorized access to the instance, when packer is creating a temporary security group. Note: If you specify `security_group_id` then this input is ignored."
   type        = bool
@@ -98,6 +110,7 @@ locals {
 source "amazon-ebs" "githubrunner" {
   ami_name                                  = "github-runner-ubuntu-jammy-amd64-${formatdate("YYYYMMDDhhmm", timestamp())}"
   instance_type                             = var.instance_type
+  iam_instance_profile                      = var.iam_instance_profile
   region                                    = var.region
   security_group_id                         = var.security_group_id
   subnet_id                                 = var.subnet_id
@@ -200,6 +213,12 @@ build {
       "sudo chmod +x /var/lib/cloud/scripts/per-boot/start-runner.sh",
     ]
   }
+
+  provisioner "shell" {
+    environment_vars = []
+    inline           = concat(var.custom_shell_commands_post_runner_install)
+  }
+
   post-processor "manifest" {
     output     = "manifest.json"
     strip_path = true
diff --git a/images/windows-core-2019/github_agent.windows.pkr.hcl b/images/windows-core-2019/github_agent.windows.pkr.hcl
index 5a31604c01..ec5bae38a0 100644
--- a/images/windows-core-2019/github_agent.windows.pkr.hcl
+++ b/images/windows-core-2019/github_agent.windows.pkr.hcl
@@ -24,6 +24,12 @@ variable "instance_type" {
   default     = "t3a.medium"
 }
 
+variable "iam_instance_profile" {
+  description = "IAM instance profile Packer will use for the builder. An empty string (default) means no profile will be assigned."
+  type        = string
+  default     = ""
+}
+
 variable "ebs_delete_on_termination" {
   description = "Indicates whether the EBS volume is deleted on instance termination."
   type        = bool
@@ -42,6 +48,12 @@ variable "custom_shell_commands" {
   default     = []
 }
 
+variable "custom_shell_commands_post_runner_install" {
+  description = "Additional commands to run on the EC2 instance, to customize the instance, like installing packages. This runs after the agent is installed."
+  type        = list(string)
+  default     = []
+}
+
 variable "temporary_security_group_source_public_ip" {
   description = "When enabled, use public IP of the host (obtained from https://checkip.amazonaws.com) as CIDR block to be authorized access to the instance, when packer is creating a temporary security group. Note: If you specify `security_group_id` then this input is ignored."
   type        = bool
@@ -64,6 +76,7 @@ source "amazon-ebs" "githubrunner" {
   ami_name                                  = "github-runner-windows-core-2019-${formatdate("YYYYMMDDhhmm", timestamp())}"
   communicator                              = "winrm"
   instance_type                             = var.instance_type
+  iam_instance_profile                      = var.iam_instance_profile
   region                                    = var.region
   associate_public_ip_address               = var.associate_public_ip_address
   temporary_security_group_source_public_ip = var.temporary_security_group_source_public_ip
@@ -112,8 +125,9 @@ build {
       templatefile("./windows-provisioner.ps1", {
         action_runner_url = "https://github.com/actions/runner/releases/download/v${local.runner_version}/actions-runner-win-x64-${local.runner_version}.zip"
       })
-    ], var.custom_shell_commands)
+    ], var.custom_shell_commands, var.custom_shell_commands_post_runner_install)
   }
+
   post-processor "manifest" {
     output     = "manifest.json"
     strip_path = true
diff --git a/images/windows-core-2022/github_agent.windows.pkr.hcl b/images/windows-core-2022/github_agent.windows.pkr.hcl
index 18a5ee93c3..4b42d97be9 100644
--- a/images/windows-core-2022/github_agent.windows.pkr.hcl
+++ b/images/windows-core-2022/github_agent.windows.pkr.hcl
@@ -18,6 +18,18 @@ variable "region" {
   default     = "eu-west-1"
 }
 
+variable "instance_type" {
+  description = "The instance type Packer will use for the builder"
+  type        = string
+  default     = "m4.xlarge"
+}
+
+variable "iam_instance_profile" {
+  description = "IAM instance profile Packer will use for the builder. An empty string (default) means no profile will be assigned."
+  type        = string
+  default     = ""
+}
+
 variable "security_group_id" {
   description = "The ID of the security group Packer will associate with the builder to enable access"
   type        = string
@@ -53,6 +65,12 @@ variable "custom_shell_commands" {
   default     = []
 }
 
+variable "custom_shell_commands_post_runner_install" {
+  description = "Additional commands to run on the EC2 instance, to customize the instance, like installing packages. This runs after the agent is installed."
+  type        = list(string)
+  default     = []
+}
+
 variable "temporary_security_group_source_public_ip" {
   description = "When enabled, use public IP of the host (obtained from https://checkip.amazonaws.com) as CIDR block to be authorized access to the instance, when packer is creating a temporary security group. Note: If you specify `security_group_id` then this input is ignored."
   type        = bool
@@ -74,7 +92,8 @@ locals {
 source "amazon-ebs" "githubrunner" {
   ami_name                                  = "github-runner-windows-core-2022-${formatdate("YYYYMMDDhhmm", timestamp())}"
   communicator                              = "winrm"
-  instance_type                             = "m4.xlarge"
+  instance_type                             = var.instance_type
+  iam_instance_profile                      = var.iam_instance_profile
   region                                    = var.region
   security_group_id                         = var.security_group_id
   subnet_id                                 = var.subnet_id
@@ -126,7 +145,7 @@ build {
       templatefile("./windows-provisioner.ps1", {
         action_runner_url = "https://github.com/actions/runner/releases/download/v${local.runner_version}/actions-runner-win-x64-${local.runner_version}.zip"
       })
-    ], var.custom_shell_commands)
+    ], var.custom_shell_commands, var.custom_shell_commands_post_runner_install)
   }
   post-processor "manifest" {
     output     = "manifest.json"