diff --git a/config/config.yaml b/config/config.yaml
index 807cabd2..a89ace7e 100644
--- a/config/config.yaml
+++ b/config/config.yaml
@@ -468,6 +468,7 @@ policy:
               cgo: false
               features:
                 - nightly-e2e
+                - go-cache-prune
                 - fips
                 - mcp-qualification
                 - pr-no-cache-export
diff --git a/policy/templates/releng/.github/workflows/release.yml.d/goreleaser.gotmpl b/policy/templates/releng/.github/workflows/release.yml.d/goreleaser.gotmpl
index 77b26e6b..a01ae6a7 100644
--- a/policy/templates/releng/.github/workflows/release.yml.d/goreleaser.gotmpl
+++ b/policy/templates/releng/.github/workflows/release.yml.d/goreleaser.gotmpl
@@ -294,6 +294,22 @@
       # so re-hashing here would save under a key the next run never looks up,
       # causing a perpetual re-save + cache eviction. Skip if we already had an
       # exact hit (nothing new to store).
+{{- if has "go-cache-prune" .Branchvals.Features }}
+      #
+      # Prune before saving: a partial restore (restore-keys) is saved under a
+      # new key on every go.sum change, so without this the cache only grows.
+      # Go bumps the mtime of entries it uses, so anything untouched for 2+
+      # days is not part of the working set. The build container runs as root,
+      # so the files are root-owned and deleting them needs sudo.
+      - name: Prune Go build cache
+        if: {{`${{ github.event_name != 'pull_request' && steps.go-cache.outputs.cache-hit != 'true' }}`}}
+        run: |
+          SUDO=""
+          if [ "$(id -u)" -ne 0 ]; then SUDO="sudo"; fi
+          echo "before:"; $SUDO du -sh ~/.cache/go-build ~/go/pkg/mod || true
+          $SUDO find ~/.cache/go-build -type f -mtime +2 -delete
+          echo "after:"; $SUDO du -sh ~/.cache/go-build ~/go/pkg/mod || true
+{{- end }}
       - name: Save Go build cache
         uses: WarpBuilds/cache/save@f643a1ba29942d56621d07fc2d4284c7219868ad  # v1
         if: {{`${{ github.event_name != 'pull_request' && steps.go-cache.outputs.cache-hit != 'true' }}`}}
diff --git a/policy/testdata/golden/tyk-analytics/master/.github/workflows/release.yml b/policy/testdata/golden/tyk-analytics/master/.github/workflows/release.yml
index 743675db..8b0a3abf 100644
--- a/policy/testdata/golden/tyk-analytics/master/.github/workflows/release.yml
+++ b/policy/testdata/golden/tyk-analytics/master/.github/workflows/release.yml
@@ -248,6 +248,20 @@ jobs:
       # so re-hashing here would save under a key the next run never looks up,
       # causing a perpetual re-save + cache eviction. Skip if we already had an
       # exact hit (nothing new to store).
+      #
+      # Prune before saving: a partial restore (restore-keys) is saved under a
+      # new key on every go.sum change, so without this the cache only grows.
+      # Go bumps the mtime of entries it uses, so anything untouched for 2+
+      # days is not part of the working set. The build container runs as root,
+      # so the files are root-owned and deleting them needs sudo.
+      - name: Prune Go build cache
+        if: ${{ github.event_name != 'pull_request' && steps.go-cache.outputs.cache-hit != 'true' }}
+        run: |
+          SUDO=""
+          if [ "$(id -u)" -ne 0 ]; then SUDO="sudo"; fi
+          echo "before:"; $SUDO du -sh ~/.cache/go-build ~/go/pkg/mod || true
+          $SUDO find ~/.cache/go-build -type f -mtime +2 -delete
+          echo "after:"; $SUDO du -sh ~/.cache/go-build ~/go/pkg/mod || true
       - name: Save Go build cache
         uses: WarpBuilds/cache/save@f643a1ba29942d56621d07fc2d4284c7219868ad # v1
         if: ${{ github.event_name != 'pull_request' && steps.go-cache.outputs.cache-hit != 'true' }}