diff --git a/.repo/pyproject.toml b/.repo/pyproject.toml
index ce452dc..e8307ca 100644
--- a/.repo/pyproject.toml
+++ b/.repo/pyproject.toml
@@ -17,3 +17,8 @@ build-backend = "hatchling.build"
 
 [tool.hatch.build.targets.wheel]
 packages = ["governance"]
+
+# No .pytest_cache: the suite is fast enough that the cache buys nothing, and it
+# would land on the workspace bind mount. Fixtures already live in tmp_path.
+[tool.pytest.ini_options]
+addopts = "-p no:cacheprovider"
diff --git a/README.md b/README.md
index 3a7bfeb..7d72564 100644
--- a/README.md
+++ b/README.md
@@ -110,6 +110,13 @@ If settings aren't applying after changes, rebuild without cache:
 Named volumes may initialize with root ownership. The `ensure_writable_dir` function in `common.sh` and the
 `base_setup_config_dirs` step handle this for base volumes; they recurse only when a directory's own owner is wrong.
 
+### Running out of disk
+
+Docker-in-Docker keeps its images and build cache on a volume that survives rebuilds, so it only grows. `task
+docker:prune` removes the build cache, stopped containers and unused images, and keeps every volume (stack data
+included). Under Docker Desktop on Windows, the freed space can stay allocated in WSL's virtual disk until that
+`.vhdx` is compacted (`wsl --shutdown`, then `Optimize-VHD` or `diskpart`'s `compact vdisk`).
+
 ### Tool installation failures
 
 Base setup uses `retry` with 3 attempts and 5-second delays for network operations. If a tool consistently fails to
diff --git a/Taskfile.yml b/Taskfile.yml
index bba81e4..d97e4a6 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -72,6 +72,14 @@ tasks:
     cmds:
       - bash .devcontainer/scripts/startup.sh
 
+  docker:prune:
+    desc: Free Docker-in-Docker disk -- build cache, stopped containers, unused images. Keeps every volume.
+    cmds:
+      - docker container prune --force
+      - docker image prune --all --force
+      - docker builder prune --all --force
+      - docker system df
+
   env:setup:
     desc: Fill in the values the enabled stacks need, interactively.
     interactive: true