diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
index b8c2478..409c09f 100644
--- a/.gitea/workflows/build-image.yml
+++ b/.gitea/workflows/build-image.yml
@@ -157,6 +157,21 @@ jobs:
           docker push "${IMAGE}:latest"
           docker push "${IMAGE}:${TAG}"
 
+      - name: Remove this run's image and cap the build cache
+        # The build runs on the HOST daemon, so whatever it leaves stays on the
+        # runner host for good: every run used to leave two tagged images, and
+        # each newer `latest` turned the previous one into a permanent `sha-` image
+        # until the host ran out of disk. Both tags are in the registry by now, so
+        # the local copies are dead weight. BuildKit keeps its layer cache apart
+        # from the images, so the next build stays fast; the cache is pruned to a
+        # cap instead of growing forever (`--reserved-space` is the same flag's
+        # name on newer Docker). Runs even after a failure, and never fails the job.
+        if: always()
+        run: |
+          docker image rm "${IMAGE}:latest" "${IMAGE}:${TAG}" 2>/dev/null || true
+          docker builder prune -f --keep-storage 5GB \
+            || docker builder prune -f --reserved-space 5GB || true
+
       - name: Log out
         if: always()
         run: docker logout "${REGISTRY}" || true
@@ -207,3 +222,11 @@ jobs:
           echo "::error::The site did not become healthy within 150s."
           docker compose logs --tail 100 site
           exit 1
+
+      - name: Remove the image this deploy replaced
+        # The pull moves `latest` to the new image and leaves the old one untagged
+        # on the host. Untagged images are never used again (a rollback pulls a
+        # `sha-` tag from the registry), so drop them. Dangling images only: nothing
+        # tagged and nothing a container is using is touched.
+        if: always()
+        run: docker image prune -f || true