diff --git a/README.md b/README.md
index 38c915e..0b9f1b3 100644
--- a/README.md
+++ b/README.md
@@ -59,6 +59,29 @@ If you want to install SLURM and use it as the scheduler, you can use e.g.:
       aiida_conda_code_computer: local_slurm_conda
 ```
 
+### Disk optimisation
+
+To optimise the disk usage, before packaging, there are a few extra steps you can take.
+These are not included in the role, since they are not idempotent, and so should only be run after a full build:
+
+```yaml
+- name: Run the equivalent of "apt-get clean"
+  apt:
+    clean: yes
+- name: wipe apt lists
+  become: true
+  command: "rm -rf /var/lib/apt/lists/*"
+- name: wipe user cache
+  file:
+    state: absent
+    path: "~/.cache"
+- name: wipe root cache
+  become: true
+  file:
+    state: absent
+    path: "~/.cache"
+```
+
 ## Usage
 
 ### Environment management
@@ -228,6 +251,7 @@ Please direct inquiries regarding Quantum Mobile and associated ansible roles to
 - rest api service
 - check everything still works with non-root user install
 - migrate tasks from `marvel-nccr.simulationbase` (understand `hostname.yml`, which is non-container only, and `clean.yml`)
+  - double-check when to use `apt: clean` and `apt: upgrade`, etc
 - Get <https://github.com/quanshengwu/wannier_tools> on Conda, to replace `marvel-nccr.wannier_tools`
 
 - run code tests (how to check success <https://github.com/aiidateam/aiida-common-workflows/issues/289>?):
diff --git a/defaults/main.yml b/defaults/main.yml
index 7c56e9c..6c81bc1 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -9,10 +9,11 @@ aiida_data_folder_temp: "${HOME}/.local/share/aiida"
 aiida_allow_mpi_on_root: false  # should only be set for containers
 aiida_create_swapfile: false
 aiida_apt_packages:
+- aptitude  # desirable for the apt ansible module
+- python3-pkg-resources    # required by the pip ansible module
 - vim    # required for manual verdi code/computer setup
 - ssh    # required by MPI
 - git    # useful for cloning repositories
-- python3-pkg-resources    # required by the pip ansible module
 
 # postgresql install
 aiida_postgres_user: postgres
diff --git a/handlers/main.yml b/handlers/main.yml
index 791b73d..c47227f 100644
--- a/handlers/main.yml
+++ b/handlers/main.yml
@@ -1,3 +1,20 @@
 - name: conda clean
   # for a discussion on using -f, see: https://github.com/jupyter/docker-stacks/issues/861
   command: "{{ conda_exec_user }} clean --yes --all -f"
+
+# https://askubuntu.com/questions/3167/what-is-difference-between-the-options-autoclean-autoremove-and-clean
+# https://github.com/ansible/ansible/issues/38920#issuecomment-1016640378
+
+- name: apt clean
+  become: true
+  listen:
+  - apt clean
+  apt:
+    autoclean: true
+
+- name: apt autoremove
+  become: true
+  listen:
+  - apt clean
+  apt:
+    autoremove: true
diff --git a/tasks/postgresql.yml b/tasks/postgresql.yml
index 8b28f95..c918c44 100644
--- a/tasks/postgresql.yml
+++ b/tasks/postgresql.yml
@@ -9,6 +9,7 @@
     - postgresql-server-dev-all
     - postgresql-client
     - python3-psycopg2  # required for postgresql_db role
+  notify: apt clean
 
 - when: ansible_service_mgr == "systemd"
   block:
diff --git a/tasks/rabbitmq.yml b/tasks/rabbitmq.yml
index f460c8e..9fde95e 100644
--- a/tasks/rabbitmq.yml
+++ b/tasks/rabbitmq.yml
@@ -6,6 +6,7 @@
   ansible.builtin.apt:
     name:
     - rabbitmq-server
+  notify: apt clean
 
 - when: ansible_service_mgr == "systemd"
   block:
diff --git a/tasks/shared.yml b/tasks/shared.yml
index 6f2be01..0b18568 100644
--- a/tasks/shared.yml
+++ b/tasks/shared.yml
@@ -7,6 +7,7 @@
     update_cache: true
     cache_valid_time: 3600
     name: "{{ aiida_apt_packages }}"
+  notify: apt clean
 
 - name: ensure that {{ aiida_temp_folder }} directory exists
   ansible.builtin.file: