diff --git a/.github/workflows/deploy-production.yaml b/.github/workflows/deploy-production.yaml
index c71a34b38..7ee2a3c49 100644
--- a/.github/workflows/deploy-production.yaml
+++ b/.github/workflows/deploy-production.yaml
@@ -88,7 +88,8 @@ jobs:
     needs: start-notification
     runs-on: ubuntu-latest
     steps:
-      - name: Configure host authenticity
+      - &ssh-host-auth
+        name: Configure host authenticity
         run: |
           mkdir -p ~/.ssh/ && chmod 700 ~/.ssh/
           touch ~/.ssh/known_hosts && chmod 600 ~/.ssh/known_hosts
@@ -106,8 +107,8 @@ jobs:
             cp ~/.env-production dashboard-production/.env &&
             cd dashboard-production &&
             git checkout ${GITHUB_SHA} &&
-            docker compose -f docker-compose-next.yml pull &&
-            docker compose -f docker-compose-next.yml up -d
+            docker compose -f docker-compose-next.yml pull --policy=always &&
+            docker compose -f docker-compose-next.yml up -d --remove-orphans
           "
         env:
           SSH_USER: ${{ secrets.STAGING_USER }}
@@ -129,3 +130,24 @@ jobs:
         uses: Ilshidur/action-discord@master
         with:
           args: "Production Dashboard deployment failed with tag `${{ github.event.inputs.tag }}`"
+
+  cleanup:
+    needs: deploy-production
+    runs-on: ubuntu-latest
+    steps:
+      - *ssh-host-auth
+      - name: Prune docker artifacts on remote
+        env:
+          SSH_USER: ${{ secrets.STAGING_USER }}
+          SSH_HOST: ${{ secrets.STAGING_HOST }}
+          SSH_KEY: ${{ secrets.STAGING_KEY }}
+        run: |
+          eval $(ssh-agent -s)
+          echo "$SSH_KEY" | ssh-add - >/dev/null
+          ssh "${SSH_USER}@${SSH_HOST}" <<<'EOF'
+            set -eu
+            docker image prune -fa --filter "until=48h"
+            docker builder prune -f --filter "until=48h"
+            docker volume ls --filter dangling=true --format "::warning::volume {{.Name}} is dangling"
+            docker container ls --filter status=exited --format "::warning::container {{.ID}} {{.Status}} ({{.Names}})"
+          EOF
diff --git a/.github/workflows/deploy-staging.yaml b/.github/workflows/deploy-staging.yaml
index 26973dc57..6d577427b 100644
--- a/.github/workflows/deploy-staging.yaml
+++ b/.github/workflows/deploy-staging.yaml
@@ -49,14 +49,15 @@ jobs:
     needs: check-migrations
     runs-on: ubuntu-latest
     steps:
-      - name: Configure staging host authenticity
+      - &ssh-host-auth
+        name: Configure staging host authenticity
         run: |
           mkdir -p ~/.ssh/ && chmod 700 ~/.ssh/
           touch ~/.ssh/known_hosts && chmod 600 ~/.ssh/known_hosts
           echo "$SSH_HOSTKEY" > ~/.ssh/known_hosts
         env:
           SSH_HOSTKEY: ${{ secrets.STAGING_HOSTKEY }}
-            
+
       - name: Deploy to staging
         run: |
           eval $(ssh-agent -s)
@@ -67,15 +68,36 @@ jobs:
             cp ~/.env-staging dashboard-staging/.env &&
             cd dashboard-staging &&
             git checkout ${GITHUB_SHA} &&
-            docker compose down &&
+            docker compose pull --ignore-buildable --policy=always &&
             docker compose build --no-cache &&
-            docker compose up -d
+            docker compose up -d --remove-orphans
           "
         env:
           SSH_USER: ${{ secrets.STAGING_USER }}
           SSH_HOST: ${{ secrets.STAGING_HOST }}
           SSH_KEY: ${{ secrets.STAGING_KEY }}
 
+  cleanup:
+    needs: deploy-staging
+    runs-on: ubuntu-latest
+    steps:
+      - *ssh-host-auth
+      - name: Prune docker artifacts on remote
+        env:
+          SSH_USER: ${{ secrets.STAGING_USER }}
+          SSH_HOST: ${{ secrets.STAGING_HOST }}
+          SSH_KEY: ${{ secrets.STAGING_KEY }}
+        run: |
+          eval $(ssh-agent -s)
+          echo "$SSH_KEY" | ssh-add - >/dev/null
+          ssh "${SSH_USER}@${SSH_HOST}" <<<'EOF'
+            set -eu
+            docker image prune -fa --filter "until=48h"
+            docker builder prune -f --filter "until=48h"
+            docker volume ls --filter dangling=true --format "::warning::volume {{.Name}} is dangling"
+            docker container ls --filter status=exited --format "::warning::container {{.ID}} {{.Status}} ({{.Names}})"
+          EOF
+
   e2e-tests:
     runs-on: ubuntu-latest
     timeout-minutes: 10
diff --git a/.github/workflows/staging-db.yaml b/.github/workflows/staging-db.yaml
index 761e8fffa..007c9c276 100644
--- a/.github/workflows/staging-db.yaml
+++ b/.github/workflows/staging-db.yaml
@@ -24,5 +24,23 @@ jobs:
           git fetch
           git checkout ${{ github.event.inputs.GIT_BRANCH }}
           cd ..
+          docker compose -f docker-compose-all.yaml --profile=self-hosted pull --ignore-buildable
           docker compose -f docker-compose-all.yaml --profile=self-hosted build
           docker compose -f docker-compose-all.yaml --profile=self-hosted up -d --remove-orphans
+
+  cleanup:
+    runs-on: ubuntu-latest
+    needs: deploy
+    steps:
+    - name: Prune docker artifacts on remote
+      uses: appleboy/ssh-action@v1
+      with:
+        host: ${{ secrets.DB_SSH_HOST }}
+        username: ${{ secrets.DB_SSH_USER }}
+        key: ${{ secrets.DB_SSH_KEY }}
+        script: |
+          set -eu
+          docker image prune -fa --filter "until=48h"
+          docker builder prune -f --filter "until=48h"
+          docker volume ls --filter dangling=true --format "::warning::volume {{.Name}} is dangling"
+          docker container ls --filter status=exited --format "::warning::container {{.ID}} {{.Status}} ({{.Names}})"