diff --git a/apps/registry/retention-script.yaml b/apps/registry/retention-script.yaml
index 603383a..63ecedb 100644
--- a/apps/registry/retention-script.yaml
+++ b/apps/registry/retention-script.yaml
@@ -85,7 +85,7 @@ data:
         rows.append((created, t, digest))
 
       rows.sort(key=lambda x: x[0], reverse=True)
-      KEEP_N=3   # keep last 3 SHA builds (was 1; bumped to prevent auth-blast-radius wipeouts)
+      KEEP_N=2   # keep last 2 SHA builds (current + 1 previous)
       keep_set=set(t for _, t, _ in rows[:KEEP_N])
       # preserve any -latest aliases regardless of age
       keep_set.update(t for t in tags if t.endswith('-latest'))