diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index f87d118..4000e28 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -123,3 +123,45 @@ jobs:
               "${REPO_API}/actions/workflows/${workflow}/dispatches")
             echo "  -> HTTP ${HTTP_CODE}"
           done
+
+      - name: Clean up old app releases
+        env:
+          BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
+        run: |
+          REPO_API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
+          KEEP=3
+          PROTECT_TAG="v1.4.0"
+
+          echo "Cleaning up old app releases (keeping latest ${KEEP} + ${PROTECT_TAG})..."
+
+          # Get all app releases (v* tags, not sidecar-v*)
+          RELEASES=$(curl -s -H "Authorization: token ${BUILD_TOKEN}" \
+            "${REPO_API}/releases?limit=50" | jq -c '[.[] | select(.tag_name | startswith("v")) | select(.tag_name | startswith("sidecar") | not)]')
+
+          TOTAL=$(echo "$RELEASES" | jq 'length')
+          echo "Found ${TOTAL} app releases"
+
+          if [ "$TOTAL" -le "$KEEP" ]; then
+            echo "Nothing to clean up"
+            exit 0
+          fi
+
+          # Skip the newest KEEP releases, delete the rest (except protected)
+          echo "$RELEASES" | jq -c ".[$KEEP:][]" | while read -r release; do
+            ID=$(echo "$release" | jq -r '.id')
+            TAG=$(echo "$release" | jq -r '.tag_name')
+
+            if [ "$TAG" = "$PROTECT_TAG" ]; then
+              echo "  Protecting ${TAG}"
+              continue
+            fi
+
+            echo "  Deleting release ${TAG} (ID: ${ID})..."
+            curl -s -X DELETE -H "Authorization: token ${BUILD_TOKEN}" \
+              "${REPO_API}/releases/${ID}"
+
+            # Also delete the tag
+            curl -s -X DELETE -H "Authorization: token ${BUILD_TOKEN}" \
+              "${REPO_API}/tags/${TAG}"
+          done
+          echo "Cleanup complete"
diff --git a/.gitea/workflows/sidecar-release.yml b/.gitea/workflows/sidecar-release.yml
index f7357b9..30bdc7f 100644
--- a/.gitea/workflows/sidecar-release.yml
+++ b/.gitea/workflows/sidecar-release.yml
@@ -135,3 +135,40 @@ jobs:
               "${REPO_API}/actions/workflows/${workflow}/dispatches")
             echo "  -> HTTP ${HTTP_CODE}"
           done
+
+      - name: Clean up old sidecar releases
+        if: steps.check_changes.outputs.has_changes == 'true'
+        env:
+          BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
+        run: |
+          REPO_API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
+          KEEP=2
+
+          echo "Cleaning up old sidecar releases (keeping latest ${KEEP})..."
+
+          # Get all sidecar releases (sidecar-v* tags)
+          RELEASES=$(curl -s -H "Authorization: token ${BUILD_TOKEN}" \
+            "${REPO_API}/releases?limit=50" | jq -c '[.[] | select(.tag_name | startswith("sidecar-v"))]')
+
+          TOTAL=$(echo "$RELEASES" | jq 'length')
+          echo "Found ${TOTAL} sidecar releases"
+
+          if [ "$TOTAL" -le "$KEEP" ]; then
+            echo "Nothing to clean up"
+            exit 0
+          fi
+
+          # Skip the newest KEEP releases, delete the rest
+          echo "$RELEASES" | jq -c ".[$KEEP:][]" | while read -r release; do
+            ID=$(echo "$release" | jq -r '.id')
+            TAG=$(echo "$release" | jq -r '.tag_name')
+
+            echo "  Deleting sidecar release ${TAG} (ID: ${ID})..."
+            curl -s -X DELETE -H "Authorization: token ${BUILD_TOKEN}" \
+              "${REPO_API}/releases/${ID}"
+
+            # Also delete the tag
+            curl -s -X DELETE -H "Authorization: token ${BUILD_TOKEN}" \
+              "${REPO_API}/tags/${TAG}"
+          done
+          echo "Cleanup complete"