diff --git a/.github/workflows/stackhpc-all-in-one.yml b/.github/workflows/stackhpc-all-in-one.yml
index 4c0a62f45..c6e9de859 100644
--- a/.github/workflows/stackhpc-all-in-one.yml
+++ b/.github/workflows/stackhpc-all-in-one.yml
@@ -232,3 +232,8 @@ jobs:
           OS_APPLICATION_CREDENTIAL_ID: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
           OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
         if: always()
+
+      - name: Prune Docker images over 1 week old
+        # May fail if another prune is running
+        run: sudo docker image prune --force --filter until=168h || true
+        if: always()
diff --git a/terraform/aio/README.rst b/terraform/aio/README.rst
index f3b29cda1..3646b757d 100644
--- a/terraform/aio/README.rst
+++ b/terraform/aio/README.rst
@@ -104,12 +104,6 @@ Apply the changes:
 
    terraform apply -auto-approve
 
-Use the ci-aio environment:
-
-.. code-block:: console
-
-   export KAYOBE_ENVIRONMENT=ci-aio
-
 Write Terraform outputs to a Kayobe config file:
 
 .. code-block:: console
@@ -152,6 +146,12 @@ Build a Kayobe image:
 
    sudo DOCKER_BUILDKIT=1 docker build --file .automation/docker/kayobe/Dockerfile --tag kayobe:latest .
 
+Use the ci-aio environment:
+
+.. code-block:: console
+
+   export KAYOBE_ENVIRONMENT=ci-aio
+
 Set the Kayobe Vault password env var:
 
 .. code-block:: console