diff --git a/.gitea/workflows/ansible.yml b/.gitea/workflows/ansible.yml
index f018581..7ce1612 100644
--- a/.gitea/workflows/ansible.yml
+++ b/.gitea/workflows/ansible.yml
@@ -17,6 +17,7 @@ on:
           - gitea.yml
           - vaultwarden.yml
           - runner.yml
+          - os-update.yml
 
 jobs:
   ansible:
diff --git a/ansible/os-update.yml b/ansible/os-update.yml
new file mode 100644
index 0000000..719c29b
--- /dev/null
+++ b/ansible/os-update.yml
@@ -0,0 +1,15 @@
+---
+- name: OS updates
+  hosts: infra
+  become: true
+
+  tasks:
+    - name: Update apt cache and upgrade packages
+      apt:
+        update_cache: true
+        upgrade: safe
+
+    - name: Remove unused packages
+      apt:
+        autoremove: true
+        purge: true