diff --git a/.github/workflows/build-ci-image.yml b/.github/workflows/build-ci-image.yml
index dc26328c5..797a926c1 100644
--- a/.github/workflows/build-ci-image.yml
+++ b/.github/workflows/build-ci-image.yml
@@ -22,6 +22,8 @@ on:
     paths:
       - ".github/containers/**"
       - ".github/workflows/build-ci-image.yml"
+    branches:
+      - main
   push: # Trigger rebuilds when pushing relevant files to main.
     paths:
       - ".github/containers/**"
diff --git a/.github/workflows/delete-ci-images.yml b/.github/workflows/delete-ci-images.yml
new file mode 100644
index 000000000..eaf17bfc3
--- /dev/null
+++ b/.github/workflows/delete-ci-images.yml
@@ -0,0 +1,51 @@
+# Copyright 2010 New Relic, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+---
+name: Delete CI Images
+
+on:
+  schedule:
+    - cron: "15 17 1 * *" # At 17:15 UTC on the 1st day of every month
+  workflow_dispatch: # Allow manual trigger
+    inputs:
+      dry-run:
+        description: "Dry run mode"
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: ${{ github.workflow }} # Only 1 job ever allowed at a time
+  cancel-in-progress: true
+
+jobs:
+  ghcr-cleanup-image:
+    name: ghcr cleanup action
+    runs-on: ubuntu-latest
+    steps:
+      - uses: dataaxiom/ghcr-cleanup-action@cd0cdb900b5dbf3a6f2cc869f0dbb0b8211f50c4 # 1.0.16
+        with:
+          package: newrelic-python-agent-ci
+          exclude-tags: latest
+          delete-untagged: true
+          delete-ghost-images: true
+          delete-partial-images: true
+          delete-orphaned-images: true
+          older-than: 90 days
+          validate: true
+          dry-run: ${{ inputs.dry-run }}