diff --git a/.gitea/workflows/cleanup-packages.yml b/.gitea/workflows/cleanup-packages.yml
new file mode 100644
index 0000000..482e785
--- /dev/null
+++ b/.gitea/workflows/cleanup-packages.yml
@@ -0,0 +1,66 @@
+name: Cleanup old package versions
+
+on:
+  workflow_dispatch:
+    inputs:
+      keep:
+        description: "Number of most-recent versions to keep"
+        required: false
+        default: "5"
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Delete old scopone-android package versions
+        env:
+          TOKEN: ${{ secrets.PACKAGE_TOKEN }}
+          KEEP: ${{ github.event.inputs.keep || '5' }}
+        run: |
+          set -euo pipefail
+          BASE="https://git.sal.giize.com/api/v1/packages/mozempk"
+
+          # Fetch all generic package versions for scopone-android (paginate)
+          ALL_VERSIONS=()
+          page=1
+          while true; do
+            BATCH=$(curl -sf "$BASE?type=generic&q=scopone-android&limit=50&page=$page" \
+              -H "Authorization: token $TOKEN")
+            COUNT=$(echo "$BATCH" | python3 -c "import sys,json; data=json.load(sys.stdin); print(len(data) if isinstance(data,list) else 0)")
+            if [[ "$COUNT" -eq 0 ]]; then break; fi
+
+            # Collect package IDs sorted by version number (numeric desc)
+            IDS=$(echo "$BATCH" | python3 -c "
+          import sys,json
+          pkgs=json.load(sys.stdin)
+          # id, version fields
+          for p in pkgs:
+              print(p['id'], p.get('version','0'))
+          ")
+            while IFS=' ' read -r pid ver; do
+              ALL_VERSIONS+=("$pid $ver")
+            done <<< "$IDS"
+
+            page=$((page + 1))
+          done
+
+          TOTAL=${#ALL_VERSIONS[@]}
+          echo "Total versions found: $TOTAL"
+          if [[ $TOTAL -le $KEEP ]]; then
+            echo "Nothing to delete (total=$TOTAL <= keep=$KEEP)."
+            exit 0
+          fi
+
+          # Sort by version number numerically descending, keep first $KEEP
+          SORTED=$(printf '%s\n' "${ALL_VERSIONS[@]}" | sort -t' ' -k2 -Vr)
+          TO_DELETE=$(echo "$SORTED" | tail -n +"$((KEEP + 1))" | awk '{print $1}')
+          DELETE_COUNT=$(echo "$TO_DELETE" | wc -l)
+          echo "Deleting $DELETE_COUNT versions (keeping $KEEP most recent)…"
+
+          while IFS= read -r pid; do
+            HTTP=$(curl -sf -o /dev/null -w "%{http_code}" \
+              -X DELETE "$BASE/$pid" \
+              -H "Authorization: token $TOKEN")
+            echo "  deleted package id=$pid → HTTP $HTTP"
+          done <<< "$TO_DELETE"
+          echo "Done."