diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 5798876..11091ef 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -53,3 +53,5 @@ jobs:
           # Push only these refs: the daemon is the VM's, so `--all-tags` would also push the local :rollback tag from update.sh.
           for ref in "${refs[@]}"; do docker push "${ref}"; done
           docker logout "${REGISTRY}"
+          # Builds run on the VM's daemon: without this its build cache grows until the disk is full.
+          docker builder prune -f --filter until=48h >/dev/null 2>&1 || true
diff --git a/deploy/update.sh b/deploy/update.sh
index 312e2b2..c8b1061 100755
--- a/deploy/update.sh
+++ b/deploy/update.sh
@@ -15,6 +15,7 @@ cd "${DEPLOY_DIR:-$script_dir}"
 image_repo=git.mariuszpacek.pl/mariusz.pacek/homelab-upgrade
 healthy_timeout=${HEALTHY_TIMEOUT:-90}
 backups_kept=${BACKUPS_KEPT:-5}
+images_kept=${IMAGES_KEPT:-3}
 
 tag_arg=""
 force=0
@@ -91,6 +92,21 @@ restore_compose() {
   fi
 }
 
+# Each CI build and each deploy leaves an image of this app on the VM (over a gigabyte each), and a full disk stops
+# every app on it. Kept: the one running, the previous one (to go back) and the newest $images_kept; a failure here
+# never fails the deploy.
+prune_images() {
+  local running id count=0
+  running=$(docker inspect --format '{{.Image}}' "$(service_container server)" 2>/dev/null || true)
+  # `docker images` lists the newest first; an image with several tags appears once per tag.
+  for id in $(docker images --no-trunc --format '{{.ID}}' "$image_repo" | awk '!seen[$0]++'); do
+    count=$((count + 1))
+    [[ "$id" == "$running" || "$id" == "$previous_image" ]] && continue
+    ((count <= images_kept)) && continue
+    docker image rm -f "$id" >/dev/null 2>&1 || true
+  done
+}
+
 wait_until_up() {
   local deadline=$((SECONDS + healthy_timeout)) status
   while ((SECONDS < deadline)); do
@@ -149,6 +165,7 @@ if wait_until_up; then
     { grep -v '^TAG=' .env || true; printf 'TAG=%s\n' "$tag"; } > .env.new && chmod --reference=.env .env.new && mv .env.new .env
   fi
   revision=$(docker inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' "$(service_container server)")
+  prune_images
   echo "ok: $image_repo:$tag revision ${revision:-unknown}"
   exit 0
 fi