diff --git a/playbook/shopfloor-setup/common/GE-Enforce.ps1 b/playbook/shopfloor-setup/common/GE-Enforce.ps1
index 688e5b2..225c2f0 100644
--- a/playbook/shopfloor-setup/common/GE-Enforce.ps1
+++ b/playbook/shopfloor-setup/common/GE-Enforce.ps1
@@ -46,6 +46,25 @@ Write-EnforceLog '==============================================================
 Write-EnforceLog "=== GE-Enforce session start (PID $PID, user $env:USERNAME) ==="
 Write-EnforceLog '================================================================'
 
+# --- Log retention prune ---
+# Drops *.log files older than $retentionDays from the shopfloor log roots.
+# Cheap (flat dir scan, no recursion). Runs every cycle. Today's
+# enforce-YYYYMMDD.log is never touched (LastWriteTime = now).
+$retentionDays = 30
+$prunedCount   = 0
+foreach ($root in @('C:\Logs\Shopfloor', 'C:\Logs\SFLD', 'C:\Logs\Keyence')) {
+    if (-not (Test-Path $root)) { continue }
+    $cutoff = (Get-Date).AddDays(-$retentionDays)
+    Get-ChildItem -Path $root -Filter '*.log' -File -ErrorAction SilentlyContinue |
+        Where-Object { $_.LastWriteTime -lt $cutoff } |
+        ForEach-Object {
+            try { Remove-Item -LiteralPath $_.FullName -Force -ErrorAction Stop; $prunedCount++ } catch {}
+        }
+}
+if ($prunedCount -gt 0) {
+    Write-EnforceLog "Pruned $prunedCount log file(s) older than $retentionDays days"
+}
+
 # --- pc-type ---
 $pcTypeFile    = 'C:\Enrollment\pc-type.txt'
 $pcSubTypeFile = 'C:\Enrollment\pc-subtype.txt'