diff --git a/.github/workflows/retention-policy.yml b/.github/workflows/retention-policy.yml
new file mode 100644
index 0000000..867ed6a
--- /dev/null
+++ b/.github/workflows/retention-policy.yml
@@ -0,0 +1,37 @@
+name: Retention Policy
+
+on:
+  workflow_dispatch: # And manually on button click
+  schedule:
+    # every day at 00:05 UTC
+    - cron: '5 0 * * *'
+
+env:
+  # Use docker.io for Docker Hub if empty
+  REGISTRY: ghcr.io
+  # github.repository as <account>/<repo>
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  clean:
+    name: Clean up the registry
+
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      # Delete all untagged Docker images older than 2 weeks.
+      # https://github.com/dataaxiom/ghcr-cleanup-action
+      - name: Delete untagged Docker images on registry ${{ env.REGISTRY }}
+        uses: dataaxiom/ghcr-cleanup-action@v1
+        with:
+          older-than: 2 weeks
+          delete-untagged: true
+          delete-partial-images: true
+          exclude-tags: "^\\d+\\.\\d+\\.\\d+$|^latest$|^main$|^nightly$"
+          use-regex: true
+          packages: ${{ github.event.repository.name }}
+          owner: ${{ github.repository_owner }}
+          token: ${{ secrets.GITHUB_TOKEN }}