Should I Create A Second Agent For More Sensitive Jobs

Sorry for the lack of details, basically I have this setup:

I don’t use buildkite docker plugins and the agent builds and pushes the container to ghcr.io. My agent is running on Ubuntu 20 and installed it by following the instructions here:
https://buildkite.com/docs/agent/v3/ubuntu

And I’m happy the way my agent works. Just thinking how should I sort out setting up app servers because it requires root permissions.