diff --git a/scripts/docker-prune.sh b/scripts/docker-prune.sh
index e8b1a1fc..fde00ca0 100644
--- a/scripts/docker-prune.sh
+++ b/scripts/docker-prune.sh
@@ -3,9 +3,9 @@
 #
 # Modes:
 #   (default) — post-deploy cleanup (safe, fast):
-#     - ALL unreferenced build cache (new build will re-populate what it needs).
-#     - ALL unreferenced images older than 1h (keeps current image + very recent).
-#     - ALL stopped containers older than 1h.
+#     - Build cache older than 72h, capped at 4 GB max used space.
+#     - Unreferenced images older than 7 days (keeps rollback images around).
+#     - Stopped containers older than 24h.
 #   --force — emergency mode ("never let the disk max out"): drops everything
 #     with no age windows:
 #     - ALL unreferenced build cache,
@@ -39,9 +39,9 @@ if (( FORCE )); then
   docker image prune -af >>"$LOG_FILE" 2>&1 || true
   docker container prune -f >>"$LOG_FILE" 2>&1 || true
 else
-  docker builder prune -af >>"$LOG_FILE" 2>&1 || true
-  docker image prune -af --filter "until=1h" >>"$LOG_FILE" 2>&1 || true
-  docker container prune -f --filter "until=1h" >>"$LOG_FILE" 2>&1 || true
+  docker builder prune -af --filter "until=72h" --max-used-space=4g >>"$LOG_FILE" 2>&1 || true
+  docker image prune -af --filter "until=168h" >>"$LOG_FILE" 2>&1 || true
+  docker container prune -f --filter "until=24h" >>"$LOG_FILE" 2>&1 || true
 fi
 
 printf '\n[%s] === docker prune complete%s ===\n' "$(now)" "$( (( FORCE )) && printf ' (FORCE)' )" >>"$LOG_FILE"