diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 79069309..2a20264a 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -40,6 +40,31 @@ jobs:
     with:
       platform: ${{ matrix.platform }}
     secrets: inherit
+  cleanup:
+    needs: [bottle-pr]
+    runs-on: ubuntu-latest
+    if: ${{ needs.cd.outputs.HAS_ARTIFACTS == 'true' }}
+    env:
+      PR: ${{ needs.bottle.outputs.pr }}
+    steps:
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+      - run: |
+          REPO=$(echo ${{github.repository}} | sed -e 's_teaxyz/__')
+
+          if test -z "$PR"; then
+            echo "no PR to clean up"
+            exit 0
+          fi
+
+          aws s3 rm --recursive s3://$AWS_S3_CACHE/pull-request/$REPO/$PR
+        env:
+          AWS_S3_CACHE: ${{ secrets.AWS_S3_CACHE }}
+          PR: ${{ needs.bottle.outputs.pr }}
   bottle-standalone:
     runs-on: ubuntu-latest
     needs: [cd]