diff --git a/cleanup.d/delete_devices b/cleanup.d/delete_devices
new file mode 100755
index 0000000..620f162
--- /dev/null
+++ b/cleanup.d/delete_devices
@@ -0,0 +1,39 @@
+#!/bin/bash
+
+token_path="$1"
+base_url="$2"
+verbose="true"
+
+warn() {
+	echo "WARN: $@" >&2
+}
+log() {
+	if [[ "$verbose" == "true" ]]; then
+		echo "LOG: $@" >&2
+	fi
+}
+invoke_req() {
+	log "invoke curl $@"
+	curl -s --header "@${token_path}" --max-time 600 --connect-timeout 600 $@
+	return $?
+}
+
+ec=0
+
+log "starting device cleanup - api url: ${base_url}"
+
+for user_id in `invoke_req -X GET "${base_url}v2/users" | jq -r '.users[]|.name'`; do
+	log "processing user ${user_id}"
+	for device in `invoke_req -X GET "${base_url}v2/users/${user_id}/devices" | jq -r '.devices|sort_by(.last_seen_ts)[0:-5][]|.device_id'`; do
+		warn "deleting device ${user_id}/${device}"
+		#resp=$(invoke_req -X DELETE "${base_url}v2/users/${user_id}/devices/${device}")
+		#rc=$?
+		#if [[ "$resp" != "{}" ]]; then
+		#	ec=$rc
+		#	echo "Deletion of device '${user_id}/devices/${device}' failed:" >&2
+		#	echo "$resp" | jq '.' >&2
+		#fi
+	done
+done
+
+exit $ec
diff --git a/cleanup.d/purge_media_cache b/cleanup.d/purge_media_cache
new file mode 100755
index 0000000..c2e1f87
--- /dev/null
+++ b/cleanup.d/purge_media_cache
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+token_path="$1"
+base_url="$2"
+verbose="true"
+
+warn() {
+	echo "WARN: $@" >&2
+}
+log() {
+	if [[ "$verbose" == "true" ]]; then
+		echo "LOG: $@" >&2
+	fi
+}
+invoke_req() {
+	log "invoke curl $@"
+	curl -s --header "@${token_path}" --max-time 600 --connect-timeout 600 $@
+	return $?
+}
+
+log "starting media purge - api url: ${base_url}"
+
+cutoff_ts="$(date -d '-9 months' '+%s')000"
+
+response="$(invoke_req -X POST --data-raw '{}' "${base_url}v1/purge_media_cache?before_ts=${cutoff_ts}")"
+rc=$?
+
+if [[ "$(echo "$response" | jq -r '.deleted')" == "null" ]]; then
+	warn "purge failed: $response"
+fi
+
+exit $rc
diff --git a/install.sh b/install.sh
new file mode 100755
index 0000000..9d3e7af
--- /dev/null
+++ b/install.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+BASEDIR=$(dirname $0)
+
+install --owner=0 --group=0 --mode=444 $BASEDIR/matrix-synapse-maintenance.service /etc/systemd/system/
+
+mkdir -p /etc/matrix-synapse/cleanup.d
+install --owner=0 --group=0 --mode=555 $BASEDIR/cleanup.d/* /etc/matrix-synapse/cleanup.d/
diff --git a/matrix-synapse-maintenance.service b/matrix-synapse-maintenance.service
new file mode 100644
index 0000000..8cc74aa
--- /dev/null
+++ b/matrix-synapse-maintenance.service
@@ -0,0 +1,23 @@
+[Unit]
+Description=cleanup tasks for the matrix synapse service
+
+After=matrix-synapse.service
+BindsTo=matrix-synapse.service
+Requisite=matrix-synapse.service
+
+# Please create a token file
+ConditionPathExists=/etc/matrix-synapse/cleanup.token
+
+[Service]
+Type=simple
+LoadCredential=token_header:/etc/matrix-synapse/cleanup.token
+
+ExecStart=/usr/bin/run-parts --verbose --arg=%d/token_header --arg=http://127.0.0.1:8008/_synapse/admin/ -- /etc/matrix-synapse/cleanup.d
+
+# Matrix user isn't needed for the current scripts
+# User=matrix-synapse
+# Group=matrix-synapse
+DynamicUser=yes
+
+ProtectSystem=strict
+ConfigurationDirectory=matrix-synapse/cleanup.d