diff --git a/.github/workflows/registry-clean.yml b/.github/workflows/registry-clean.yml
new file mode 100644
index 0000000..e00df4f
--- /dev/null
+++ b/.github/workflows/registry-clean.yml
@@ -0,0 +1,103 @@
+# This workflow runs daily to clean up images older than the cut-off
+# period specified in each `snok/container-retention-policy`.
+#
+# Both testing and production images are being cleaned up, with separate
+# retention policies.
+#
+# For `postgresql-trunk-testing` images:
+# - Delete everything that's older than 1 week
+#
+# For `postgresql-trunk` images:
+# - Delete all rolling-upgrade-e2e tags older than 1 week (these are retags required only by E2Es)
+# - Delete `-minimal` images older than 1 week, keeping the most recent tag for each distro
+# - Delete `-standard` images older than 1 week, keeping the most recent tag for each distro
+# - Delete `-postgis` images older than 1 week, keeping the most recent tag for each distro
+# - Delete untagged/orphaned layers older than 1 week
+#
+# Tags produced by build.yml / build-commitfest.yml are never deleted.
+name: clean-testing-package
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * *'
+
+permissions: {}
+
+env:
+  IMAGE_NAME_TESTING: "postgresql-trunk-testing"
+  IMAGE_NAME: "postgresql-trunk"
+  DEBIAN_STABLE: trixie
+  DEBIAN_OLDSTABLE: bookworm
+
+jobs:
+  clean-ghcr:
+    name: delete old testing container images
+    permissions:
+      contents: read
+      packages: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Delete '-testing' operand images in ${{ env.IMAGE_NAME_TESTING }}
+        uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0
+        with:
+          image-names: ${{ env.IMAGE_NAME_TESTING }}
+          cut-off: 1w
+          keep-n-most-recent: 1
+          account: ${{ github.repository_owner }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Delete old rolling-upgrade-e2e images in ${{ env.IMAGE_NAME }}
+        uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0
+        with:
+          image-names: ${{ env.IMAGE_NAME }}
+          image-tags: "*rolling-upgrade-e2e*"
+          tag-selection: tagged
+          cut-off: 1w
+          account: ${{ github.repository_owner }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Keep only the latest postgis image per distro in ${{ env.IMAGE_NAME }}
+        uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0
+        with:
+          image-names: ${{ env.IMAGE_NAME }}
+          image-tags: "*-postgis-${{ env.DEBIAN_STABLE }} *-postgis-${{ env.DEBIAN_OLDSTABLE }}"
+          tag-selection: tagged
+          cut-off: 1w
+          keep-n-most-recent: 1
+          account: ${{ github.repository_owner }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Keep only the latest standard image per distro in ${{ env.IMAGE_NAME }}
+        uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0
+        with:
+          image-names: ${{ env.IMAGE_NAME }}
+          image-tags: "*-standard-${{ env.DEBIAN_STABLE }} *-standard-${{ env.DEBIAN_OLDSTABLE }}"
+          tag-selection: tagged
+          cut-off: 1w
+          keep-n-most-recent: 1
+          account: ${{ github.repository_owner }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Keep only the latest minimal image per distro in ${{ env.IMAGE_NAME }}
+        uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0
+        with:
+          image-names: ${{ env.IMAGE_NAME }}
+          image-tags: "*-minimal-${{ env.DEBIAN_STABLE }} *-minimal-${{ env.DEBIAN_OLDSTABLE }}"
+          tag-selection: tagged
+          cut-off: 1w
+          keep-n-most-recent: 1
+          account: ${{ github.repository_owner }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      # Runs last and only considers untagged versions (dangling SBOM/provenance
+      # attestation manifests, orphaned layers), independently of the tag rules
+      # above -- image-tags does not apply to untagged versions.
+      - name: Delete dangling untagged images in ${{ env.IMAGE_NAME }}
+        uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0
+        with:
+          image-names: ${{ env.IMAGE_NAME }}
+          tag-selection: untagged
+          cut-off: 1w
+          account: ${{ github.repository_owner }}
+          token: ${{ secrets.GITHUB_TOKEN }}