diff --git a/.github/workflows/clean-up-images.yml b/.github/workflows/clean-up-images.yml
new file mode 100644
index 000000000..2289b8008
--- /dev/null
+++ b/.github/workflows/clean-up-images.yml
@@ -0,0 +1,21 @@
+name: Clean Up Images
+
+on:
+  schedule:
+    - cron: '0 0 * * *'  # every day at midnight
+
+jobs:
+  clean-ghcr:
+    name: Clean up untagged images
+    runs-on: ubuntu-latest
+    steps:
+      - name: Delete untagged images older than three days
+        uses: snok/container-retention-policy@v1
+        with:
+          image-names: logto
+          cut-off: Three days ago UTC
+          account-type: org
+          org-name: logto-io
+          keep-at-least: 1
+          untagged-only: true
+          token: ${{ secrets.BOT_PAT }}