diff --git a/.github/workflows/docker-ghcr-cleanup.yml b/.github/workflows/docker-ghcr-cleanup.yml
new file mode 100644
index 000000000..e07e01f7c
--- /dev/null
+++ b/.github/workflows/docker-ghcr-cleanup.yml
@@ -0,0 +1,29 @@
+name: Cleanup Old Container Images
+
+on:
+  schedule:
+    - cron: '30 3 * * 0'   # weekly, Sunday 03:30 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    # Only run in the upstream repo — forks shouldn't run scheduled jobs
+    # against their own packages using this hardcoded config, and cron
+    # triggers fire on forks too unless guarded like this.
+    if: github.repository == 'pixelfed/pixelfed'
+    steps:
+      - name: Clean up old images
+        uses: dataaxiom/ghcr-cleanup-action@v1
+        with:
+          owner: pixelfed
+          package: pixelfed
+
+          exclude-tags: 'latest,staging,unstable,stable,v*.*.*'
+          older-than: 6 months
+          delete-untagged: true
+          keep-n-tagged: 25