diff --git a/ansible/roles/os-update/files/pacman-cache.hook b/ansible/roles/os-update/files/pacman-cache.hook
new file mode 100644
index 00000000..1fa1597e
--- /dev/null
+++ b/ansible/roles/os-update/files/pacman-cache.hook
@@ -0,0 +1,14 @@
+# Managed by ansible (roles/os-update).
+# Downloaded packages are not kept; older versions come from the Arch Linux
+# Archive.
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Type = Package
+Target = *
+
+[Action]
+Description = Removing downloaded packages from the cache...
+When = PostTransaction
+Exec = /usr/bin/find /var/cache/pacman/pkg -mindepth 1 -delete
diff --git a/ansible/roles/os-update/tasks/main.yml b/ansible/roles/os-update/tasks/main.yml
index d7963f05..fc2f8506 100644
--- a/ansible/roles/os-update/tasks/main.yml
+++ b/ansible/roles/os-update/tasks/main.yml
@@ -25,6 +25,34 @@
   check_mode: false
   when: os_update_docker.stat.exists
 
+# pacman keeps every downloaded package; on the edge hosts' 7 GB eMMC root
+# the cache grows to gigabytes.
+- name: Ensure the pacman hook directory exists (Arch)
+  ansible.builtin.file:
+    path: /etc/pacman.d/hooks
+    state: directory
+    mode: "0755"
+  when: ansible_facts['os_family'] == 'Archlinux'
+
+- name: Empty the package cache after every transaction (Arch)
+  ansible.builtin.copy:
+    src: pacman-cache.hook
+    dest: /etc/pacman.d/hooks/pacman-cache.hook
+    mode: "0644"
+  when: ansible_facts['os_family'] == 'Archlinux'
+
+- name: Empty the package cache (Arch)
+  ansible.builtin.command:
+    argv: [find, /var/cache/pacman/pkg, -mindepth, "1", -delete, -print]
+  register: os_update_pacman_cache
+  changed_when: os_update_pacman_cache.stdout | length > 0
+  when: ansible_facts['os_family'] == 'Archlinux'
+
+- name: Re-read mounts after the cache cleanup
+  ansible.builtin.setup:
+    gather_subset: [mounts]
+  when: os_update_pacman_cache is changed
+
 - name: Assert at least 1 GiB free on /
   ansible.builtin.assert:
     that: >-