diff --git a/README.md b/README.md
index 2bd2448..93bba1d 100644
--- a/README.md
+++ b/README.md
@@ -49,6 +49,7 @@ docker run --rm centurylink/watchtower --help
 * `--host, -h` - Docker daemon socket to connect to. Defaults to "unix:///var/run/docker.sock" but can be pointed at a remote Docker host by specifying a TCP endpoint as "tcp://hostname:port". The host value can also be provided by setting the `DOCKER_HOST` environment variable.
 * `--interval, -i` - Poll interval (in seconds). This value controls how frequently watchtower will poll for new images. Defaults to 300 seconds (5 minutes).
 * `--no-pull` - Do not pull new images. When this flag is specified, watchtower will not attempt to pull new images from the registry. Instead it will only monitor the local image cache for changes. Use this option if you are building new images directly on the Docker host without pushing them to a registry.
+* `--cleanup` - Remove old images after updating. When this flag is specified, watchtower will remove the old image after restarting a container with a new image. Use this option to prevent the accumulation of orphaned images on your system as containers are updated.
 * `--tls` - Use TLS when connecting to the Docker socket but do NOT verify the server's certificate. If you are connecting a TCP Docker socket protected by TLS you'll need to use either this flag or the `--tlsverify` flag (described below). The `--tlsverify` flag is preferred as it will cause the server's certificate to be verified before a connection is made.
 * `--tlsverify` - Use TLS when connecting to the Docker socket and verify the server's certificate. If you are connecting a TCP Docker socket protected by TLS you'll need to use either this flag or the `--tls` flag (describe above).  
 * `--tlscacert` - Trust only certificates signed by this CA. Used in conjunction with the `--tlsverify` flag to identify the CA certificate which should be used to verify the identity of the server. The value for this flag can be either the fully-qualified path to the *.pem* file containing the CA certificate or a string containing the CA certificate itself. Defaults to "/etc/ssl/docker/ca.pem".
diff --git a/actions/check.go b/actions/check.go
index 9ac2b8c..0775ed4 100644
--- a/actions/check.go
+++ b/actions/check.go
@@ -8,7 +8,7 @@ import (
 
 func watchtowerContainersFilter(c container.Container) bool { return c.IsWatchtower() }
 
-func CheckPrereqs(client container.Client) error {
+func CheckPrereqs(client container.Client, cleanup bool) error {
 	containers, err := client.ListContainers(watchtowerContainersFilter)
 	if err != nil {
 		return err
@@ -20,6 +20,10 @@ func CheckPrereqs(client container.Client) error {
 		// Iterate over all containers execept the last one
 		for _, c := range containers[0 : len(containers)-1] {
 			client.StopContainer(c, 60)
+
+			if cleanup {
+				client.RemoveImage(c)
+			}
 		}
 	}
 
diff --git a/actions/check_test.go b/actions/check_test.go
index 73a5f42..8550933 100644
--- a/actions/check_test.go
+++ b/actions/check_test.go
@@ -38,7 +38,40 @@ func TestCheckPrereqs_Success(t *testing.T) {
 	client.On("ListContainers", mock.AnythingOfType("container.Filter")).Return(cs, nil)
 	client.On("StopContainer", c2, time.Duration(60)).Return(nil)
 
-	err := CheckPrereqs(client)
+	err := CheckPrereqs(client, false)
+
+	assert.NoError(t, err)
+	client.AssertExpectations(t)
+}
+
+func TestCheckPrereqs_WithCleanup(t *testing.T) {
+	cc := &dockerclient.ContainerConfig{
+		Labels: map[string]string{"com.centurylinklabs.watchtower": "true"},
+	}
+	c1 := *container.NewContainer(
+		&dockerclient.ContainerInfo{
+			Name:    "c1",
+			Config:  cc,
+			Created: "2015-07-01T12:00:01.000000000Z",
+		},
+		nil,
+	)
+	c2 := *container.NewContainer(
+		&dockerclient.ContainerInfo{
+			Name:    "c2",
+			Config:  cc,
+			Created: "2015-07-01T12:00:00.000000000Z",
+		},
+		nil,
+	)
+	cs := []container.Container{c1, c2}
+
+	client := &mockclient.MockClient{}
+	client.On("ListContainers", mock.AnythingOfType("container.Filter")).Return(cs, nil)
+	client.On("StopContainer", c2, time.Duration(60)).Return(nil)
+	client.On("RemoveImage", c2).Return(nil)
+
+	err := CheckPrereqs(client, true)
 
 	assert.NoError(t, err)
 	client.AssertExpectations(t)
@@ -61,7 +94,7 @@ func TestCheckPrereqs_OnlyOneContainer(t *testing.T) {
 	client := &mockclient.MockClient{}
 	client.On("ListContainers", mock.AnythingOfType("container.Filter")).Return(cs, nil)
 
-	err := CheckPrereqs(client)
+	err := CheckPrereqs(client, false)
 
 	assert.NoError(t, err)
 	client.AssertExpectations(t)
@@ -73,7 +106,7 @@ func TestCheckPrereqs_ListError(t *testing.T) {
 	client := &mockclient.MockClient{}
 	client.On("ListContainers", mock.AnythingOfType("container.Filter")).Return(cs, errors.New("oops"))
 
-	err := CheckPrereqs(client)
+	err := CheckPrereqs(client, false)
 
 	assert.Error(t, err)
 	assert.EqualError(t, err, "oops")
diff --git a/actions/update.go b/actions/update.go
index d997832..c79ef70 100644
--- a/actions/update.go
+++ b/actions/update.go
@@ -15,7 +15,7 @@ var (
 
 func allContainersFilter(container.Container) bool { return true }
 
-func Update(client container.Client) error {
+func Update(client container.Client, cleanup bool) error {
 	log.Info("Checking containers for updated images")
 
 	containers, err := client.ListContainers(allContainersFilter)
@@ -70,6 +70,10 @@ func Update(client container.Client) error {
 			if err := client.StartContainer(container); err != nil {
 				log.Error(err)
 			}
+
+			if cleanup {
+				client.RemoveImage(container)
+			}
 		}
 	}
 
diff --git a/container/client.go b/container/client.go
index 9e2af12..a0865fe 100644
--- a/container/client.go
+++ b/container/client.go
@@ -21,6 +21,7 @@ type Client interface {
 	StartContainer(Container) error
 	RenameContainer(Container, string) error
 	IsContainerStale(Container) (bool, error)
+	RemoveImage(Container) error
 }
 
 func NewClient(dockerHost string, tlsConfig *tls.Config, pullImages bool) Client {
@@ -147,6 +148,13 @@ func (client DockerClient) IsContainerStale(c Container) (bool, error) {
 	return false, nil
 }
 
+func (client DockerClient) RemoveImage(c Container) error {
+	imageID := c.ImageID()
+	log.Infof("Removing image %s", imageID)
+	_, err := client.api.RemoveImage(imageID)
+	return err
+}
+
 func (client DockerClient) waitForStop(c Container, waitTime time.Duration) error {
 	timeout := time.After(waitTime)
 
diff --git a/container/client_test.go b/container/client_test.go
index b8fc75a..ffae1f1 100644
--- a/container/client_test.go
+++ b/container/client_test.go
@@ -399,3 +399,38 @@ func TestIsContainerStale_InspectImageError(t *testing.T) {
 	assert.EqualError(t, err, "uh-oh")
 	api.AssertExpectations(t)
 }
+
+func TestRemoveImage_Success(t *testing.T) {
+	c := Container{
+		imageInfo: &dockerclient.ImageInfo{
+			Id: "abc123",
+		},
+	}
+
+	api := mockclient.NewMockClient()
+	api.On("RemoveImage", "abc123").Return([]*dockerclient.ImageDelete{}, nil)
+
+	client := DockerClient{api: api}
+	err := client.RemoveImage(c)
+
+	assert.NoError(t, err)
+	api.AssertExpectations(t)
+}
+
+func TestRemoveImage_Error(t *testing.T) {
+	c := Container{
+		imageInfo: &dockerclient.ImageInfo{
+			Id: "abc123",
+		},
+	}
+
+	api := mockclient.NewMockClient()
+	api.On("RemoveImage", "abc123").Return([]*dockerclient.ImageDelete{}, errors.New("oops"))
+
+	client := DockerClient{api: api}
+	err := client.RemoveImage(c)
+
+	assert.Error(t, err)
+	assert.EqualError(t, err, "oops")
+	api.AssertExpectations(t)
+}
diff --git a/container/container.go b/container/container.go
index f7a506a..b3d9fc7 100644
--- a/container/container.go
+++ b/container/container.go
@@ -34,6 +34,10 @@ func (c Container) Name() string {
 	return c.containerInfo.Name
 }
 
+func (c Container) ImageID() string {
+	return c.imageInfo.Id
+}
+
 func (c Container) ImageName() string {
 	imageName := c.containerInfo.Config.Image
 
diff --git a/container/container_test.go b/container/container_test.go
index 34cec85..8c91c1a 100644
--- a/container/container_test.go
+++ b/container/container_test.go
@@ -23,6 +23,16 @@ func TestName(t *testing.T) {
 	assert.Equal(t, "foo", c.Name())
 }
 
+func TestImageID(t *testing.T) {
+	c := Container{
+		imageInfo: &dockerclient.ImageInfo{
+			Id: "foo",
+		},
+	}
+
+	assert.Equal(t, "foo", c.ImageID())
+}
+
 func TestImageName_Tagged(t *testing.T) {
 	c := Container{
 		containerInfo: &dockerclient.ContainerInfo{
diff --git a/container/mockclient/mock.go b/container/mockclient/mock.go
index bebd686..2338849 100644
--- a/container/mockclient/mock.go
+++ b/container/mockclient/mock.go
@@ -35,3 +35,8 @@ func (m *MockClient) IsContainerStale(c container.Container) (bool, error) {
 	args := m.Called(c)
 	return args.Bool(0), args.Error(1)
 }
+
+func (m *MockClient) RemoveImage(c container.Container) error {
+	args := m.Called(c)
+	return args.Error(0)
+}
diff --git a/main.go b/main.go
index 6151133..a225aad 100644
--- a/main.go
+++ b/main.go
@@ -22,6 +22,7 @@ var (
 	wg           sync.WaitGroup
 	client       container.Client
 	pollInterval time.Duration
+	cleanup      bool
 )
 
 func init() {
@@ -56,6 +57,10 @@ func main() {
 			Name:  "no-pull",
 			Usage: "do not pull new images",
 		},
+		cli.BoolFlag{
+			Name:  "cleanup",
+			Usage: "remove old images after updating",
+		},
 		cli.BoolFlag{
 			Name:  "tls",
 			Usage: "use TLS; implied by --tlsverify",
@@ -97,6 +102,7 @@ func before(c *cli.Context) error {
 	}
 
 	pollInterval = time.Duration(c.Int("interval")) * time.Second
+	cleanup = c.GlobalBool("cleanup")
 
 	// Set-up container client
 	tls, err := tlsConfig(c)
@@ -111,13 +117,13 @@ func before(c *cli.Context) error {
 }
 
 func start(*cli.Context) {
-	if err := actions.CheckPrereqs(client); err != nil {
+	if err := actions.CheckPrereqs(client, cleanup); err != nil {
 		log.Fatal(err)
 	}
 
 	for {
 		wg.Add(1)
-		if err := actions.Update(client); err != nil {
+		if err := actions.Update(client, cleanup); err != nil {
 			fmt.Println(err)
 		}
 		wg.Done()