diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index 440e87b..41545cc 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -267,7 +267,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Cleanup old image tags (after all builds complete)
+      - name: Cleanup old image tags (keep running + 1 previous)
         continue-on-error: true
         env:
           REGISTRY_HOST: ${{ secrets.REGISTRY_HOSTPORT }}
@@ -277,6 +277,7 @@ jobs:
         run: |
           set -euo pipefail
           echo "Starting post-build cleanup for services: $SERVICES_CSV"
+          echo "Policy: Keep only 2 SHA tags (running + 1 previous)"
           
           IFS=',' read -ra SERVICES <<< "$SERVICES_CSV"
           for service in "${SERVICES[@]}"; do
@@ -286,7 +287,7 @@ jobs:
               --repo "nxtgauge-rust-$service" \
               --username "$REGISTRY_USERNAME" \
               --password "$REGISTRY_PASSWORD" \
-              --keep 3 || echo "Warning: Failed to prune $service (continuing)"
+              --keep 2 || echo "Warning: Failed to prune $service (continuing)"
           done
           
-          echo "Post-build cleanup completed"
+          echo "Post-build cleanup completed - only 2 most recent SHA tags kept"