diff --git a/scripts/source/files/arrays/function_manifest.sh b/scripts/source/files/arrays/function_manifest.sh
index 36d6dbc..54f5ad2 100644
--- a/scripts/source/files/arrays/function_manifest.sh
+++ b/scripts/source/files/arrays/function_manifest.sh
@@ -1010,6 +1010,7 @@ declare -gA LP_FN_MAP=(
     [webuiPatchAppConfigJson]="webui/data/generators/apps/webui_config_patch.sh"
     [webuiPrintInstallCard]="webui/webui_display_logins.sh"
     [webuiPrintLoginBlock]="webui/webui_display_logins.sh"
+    [webuiPruneAppIcons]="webui/data/utils/webui_app_icons.sh"
     [_webuiReadServiceTags]="webui/data/generators/apps/webui_config.sh"
     [webuiRegistryCatalogScan]="webui/data/generators/apps/webui_registry_scan.sh"
     [webuiRemoveSetupLock]="webui/data/lock/webui_remove_setup_lock.sh"
@@ -2045,6 +2046,7 @@ declare -gA LP_FN_ROOT=(
     [webuiPatchAppConfigJson]="scripts"
     [webuiPrintInstallCard]="scripts"
     [webuiPrintLoginBlock]="scripts"
+    [webuiPruneAppIcons]="scripts"
     [_webuiReadServiceTags]="scripts"
     [webuiRegistryCatalogScan]="scripts"
     [webuiRemoveSetupLock]="scripts"
@@ -3114,6 +3116,7 @@ webuiLibrePortalUpdate() { unset -f webuiLibrePortalUpdate; __lpAutoload "${inst
 webuiPatchAppConfigJson() { unset -f webuiPatchAppConfigJson; __lpAutoload "${install_scripts_dir}webui/data/generators/apps/webui_config_patch.sh"; webuiPatchAppConfigJson "$@"; }
 webuiPrintInstallCard() { unset -f webuiPrintInstallCard; __lpAutoload "${install_scripts_dir}webui/webui_display_logins.sh"; webuiPrintInstallCard "$@"; }
 webuiPrintLoginBlock() { unset -f webuiPrintLoginBlock; __lpAutoload "${install_scripts_dir}webui/webui_display_logins.sh"; webuiPrintLoginBlock "$@"; }
+webuiPruneAppIcons() { unset -f webuiPruneAppIcons; __lpAutoload "${install_scripts_dir}webui/data/utils/webui_app_icons.sh"; webuiPruneAppIcons "$@"; }
 _webuiReadServiceTags() { unset -f _webuiReadServiceTags; __lpAutoload "${install_scripts_dir}webui/data/generators/apps/webui_config.sh"; _webuiReadServiceTags "$@"; }
 webuiRegistryCatalogScan() { unset -f webuiRegistryCatalogScan; __lpAutoload "${install_scripts_dir}webui/data/generators/apps/webui_registry_scan.sh"; webuiRegistryCatalogScan "$@"; }
 webuiRemoveSetupLock() { unset -f webuiRemoveSetupLock; __lpAutoload "${install_scripts_dir}webui/data/lock/webui_remove_setup_lock.sh"; webuiRemoveSetupLock "$@"; }
diff --git a/scripts/webui/data/utils/webui_app_icons.sh b/scripts/webui/data/utils/webui_app_icons.sh
index da00bb7..b64ebc9 100755
--- a/scripts/webui/data/utils/webui_app_icons.sh
+++ b/scripts/webui/data/utils/webui_app_icons.sh
@@ -54,5 +54,31 @@ webuiSyncAppIcons() {
         echo "❌ Install containers directory not found: $install_containers_dir"
     fi
 
+    webuiPruneAppIcons
     echo "Icon sync completed!"
 }
+
+# Drop icons whose app template no longer exists. The sync above only ever
+# ADDS, so removing an app from the catalogue left its icon being served
+# forever — harmless-looking, but it is a file the portal keeps offering for
+# something that is gone, and they accumulate release after release.
+# Only ever removes icons it can match to a missing template, never anything
+# else in the directory.
+webuiPruneAppIcons() {
+    local icons_dir="${containers_dir}libreportal/frontend/core/icons/apps"
+    [[ -d "$icons_dir" ]] || return 0
+    [[ -d "$install_containers_dir" ]] || return 0
+
+    local f base app removed=0
+    while IFS= read -r f; do
+        [[ -n "$f" ]] || continue
+        base="$(basename "$f")"
+        app="${base%.*}"
+        # Keep anything whose template is still present.
+        [[ -d "${install_containers_dir}/${app}" ]] && continue
+        runFileOp rm -f "$f" 2>/dev/null && removed=$((removed + 1))
+        echo "🧹 Removed orphaned icon for $app"
+    done < <(runFileOp find "$icons_dir" -maxdepth 1 -type f \( -name '*.svg' -o -name '*.png' \) 2>/dev/null)
+    (( removed > 0 )) && echo "Pruned $removed orphaned icon(s)."
+    return 0
+}