diff --git a/docs/manual.txt b/docs/manual.txt
index 4328ed5..8c36688 100644
--- a/docs/manual.txt
+++ b/docs/manual.txt
@@ -59,6 +59,12 @@ Custom emus may be provided by creating and populating the emus directory.
 emus may be referenced when composing a honk via colon wrapping. How pleasant.
 This :example: will be replaced by emus/example.png.
 
+-- cleanup
+
+One may occasionally run `honk cleanup` to free up internal space in the
+database. (This does not run vacuum, so the file size will not immediately
+shrink.)
+
 -- proxy
 
 honk requires a TLS terminating reverse proxy be configured. It communicates
diff --git a/honk.go b/honk.go
index ade6687..ef9b38f 100644
--- a/honk.go
+++ b/honk.go
@@ -1302,6 +1302,11 @@ func serve() {
 	}
 }
 
+func cleanupdb() {
+	db := opendatabase()
+	doordie(db, "delete from files where fileid not in (select fileid from donks)")
+}
+
 var stmtHonkers, stmtDubbers, stmtSaveHonker, stmtUpdateFlavor, stmtUpdateCombos *sql.Stmt
 var stmtOneXonk, stmtPublicHonks, stmtUserHonks, stmtHonksByCombo, stmtHonksByConvoy *sql.Stmt
 var stmtHonksForUser, stmtHonksForMe, stmtSaveDub *sql.Stmt
@@ -1403,6 +1408,8 @@ func main() {
 	getconfig("servername", &serverName)
 	prepareStatements(db)
 	switch cmd {
+	case "cleanup":
+		cleanupdb()
 	case "ping":
 		if len(os.Args) < 4 {
 			fmt.Printf("usage: honk ping from to\n")
diff --git a/upgradedb.go b/upgradedb.go
index 7a2a43f..44ad516 100644
--- a/upgradedb.go
+++ b/upgradedb.go
@@ -92,5 +92,6 @@ func upgradedb() {
 	default:
 		log.Fatalf("can't upgrade unknown version %d", dbversion)
 	}
+	cleanupdb()
 	os.Exit(0)
 }