diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 69367a90..744a3ce4 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -217,9 +217,21 @@ jobs:
             docker compose -p gendesign -f docker-compose.prod.yml exec -T caddy \
               caddy reload --config /etc/caddy/Caddyfile || true
 
-            # Clean up disk: dangling layers + tagged images older than 72h that
-            # nothing is using anymore. Plus build cache (we never build on prod
-            # but old buildkit caches may linger from earlier compose builds).
+            # Clean up disk:
+            # 1. Для каждого gendesign-* образа оставляем 2 самых свежих
+            #    SHA-тега (currently running + 1 fallback для rollback),
+            #    остальные удаляем независимо от возраста. `:latest`
+            #    никогда не трогаем. Docker images сортирует по Created
+            #    DESC по умолчанию — берём всё после первых 2 строк.
+            for repo in ghcr.io/lekss361/gendesign-backend \
+                        ghcr.io/lekss361/gendesign-worker \
+                        ghcr.io/lekss361/gendesign-frontend; do
+              docker images "$repo" --format '{{.Repository}}:{{.Tag}}' \
+                | grep -v ':latest$' \
+                | tail -n +3 \
+                | xargs -r docker rmi 2>/dev/null || true
+            done
+            # 2. dangling/unused images (untagged layers) + build cache.
             docker image prune -af --filter "until=72h" || true
             docker builder prune -af || true