diff --git a/.gitea/workflows/build-images.yml b/.gitea/workflows/build-images.yml
index 6407354..0f9cae5 100644
--- a/.gitea/workflows/build-images.yml
+++ b/.gitea/workflows/build-images.yml
@@ -93,6 +93,22 @@ jobs:
           docker push "${BOT_IMAGE}:latest"
           docker push "${BOT_IMAGE}:${TAG}"
 
+      - name: Remove this run's images and cap the build cache
+        # The build runs on the HOST daemon, so whatever it leaves stays on the
+        # runner host for good: every run used to leave four tagged images, and
+        # each newer `latest` turned the previous one into a permanent `sha-` image
+        # until the host ran out of disk. Both tags are in the registry by now, so
+        # the local copies are dead weight. BuildKit keeps its layer cache apart
+        # from the images, so the next build stays fast; the cache is pruned to a
+        # cap instead of growing forever (`--reserved-space` is the same flag's
+        # name on newer Docker). Runs even after a failure, and never fails the job.
+        if: always()
+        run: |
+          docker image rm "${APP_IMAGE}:latest" "${APP_IMAGE}:${TAG}" \
+            "${BOT_IMAGE}:latest" "${BOT_IMAGE}:${TAG}" 2>/dev/null || true
+          docker builder prune -f --keep-storage 5GB \
+            || docker builder prune -f --reserved-space 5GB || true
+
       - name: Log out (clear cached credentials from the runner)
         if: always()
         run: docker logout "${REGISTRY}" || true
diff --git a/.gitea/workflows/demo-wipe.yml b/.gitea/workflows/demo-wipe.yml
index 8515833..03d5049 100644
--- a/.gitea/workflows/demo-wipe.yml
+++ b/.gitea/workflows/demo-wipe.yml
@@ -110,6 +110,14 @@ jobs:
           docker run --rm --network rg-demo_default -v "$DEMO_DIR:/demo" \
             -e SITE_URL=http://app:3000 "$NODE_IMAGE" node /demo/rig.mjs smoke
 
+      - name: Remove the images this wipe replaced
+        # Each pull that finds a newer `latest` leaves the old image untagged on
+        # the demo host, every two hours. Untagged images are never used again, so
+        # drop them. Dangling images only: nothing tagged and nothing a container
+        # is using is touched.
+        if: always()
+        run: docker image prune -f || true
+
       - name: Report the rig restore
         if: steps.rig.outcome == 'failure'
         run: |