diff --git a/.github/workflows/docker-ci.yml b/.github/workflows/docker-ci.yml
index e764d9f..906b6a0 100644
--- a/.github/workflows/docker-ci.yml
+++ b/.github/workflows/docker-ci.yml
@@ -65,6 +65,11 @@ on:
       push-to:
         required: true
         type: string
+      # delete GHCR images older than ... (default: "one year"; state "keep" to skip)
+      ghcr-retention-policy:
+        required: false
+        default: one year
+        type: string
     secrets:
       DOCKERHUB_USERNAME:
         required: true
@@ -72,6 +77,22 @@ on:
         required: true
 
 jobs:
+  tidy-ghcr:
+    name: Delete GHCR images older than ${{ inputs.ghcr-retention-policy }}
+    runs-on: ubuntu-latest
+    if: ${{ inputs.ghcr-retention-policy != 'keep' }}
+
+    steps:
+      - name: Delete old images
+        uses: snok/container-retention-policy@v2
+        with:
+          image-names: ${{ github.event.repository.name }}
+          cut-off: ${{ inputs.ghcr-retention-policy }} ago UTC
+          account-type: org
+          org-name: samply
+          token: ${{ secrets.GITHUB_TOKEN }}
+          token-type: github-token
+
   build:
     name: Dockerize${{ inputs.binary-name && format(' ({0})', inputs.binary-name) }}${{ inputs.image-tag-suffix && format(' ({0})', inputs.image-tag-suffix) }}
     runs-on: ubuntu-latest
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index b05090f..5a61c31 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -37,6 +37,11 @@ on:
         description: "Set to none, dockerhub, ghcr or both"
         required: true
         type: string
+      # delete GHCR images older than ... (default: "one year"; state "keep" to skip)
+      ghcr-retention-policy:
+        required: false
+        default: one year
+        type: string
     secrets:
       DOCKERHUB_USERNAME:
         required: true
@@ -53,7 +58,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - uses: EmbarkStudios/cargo-deny-action@v1
 
   build:
@@ -99,7 +104,7 @@ jobs:
           else
             echo "profilestr=--profile $PROFILE" >> $GITHUB_ENV
           fi
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 #      - uses: actions-rs/toolchain@v1
 #        if: false
 #        with:
@@ -219,6 +224,7 @@ jobs:
       artifact-name: '*'
       binary-name: ${{ matrix.components }}
       push-to: ${{ inputs.push-to }}
+      ghcr-retention-policy: ${{ inputs.ghcr-retention-policy }}
     secrets:
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
       DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}