diff --git a/config/runtime.exs b/config/runtime.exs
index b0572c3090374..cac5a21f1ff6b 100644
--- a/config/runtime.exs
+++ b/config/runtime.exs
@@ -589,6 +589,8 @@ base_cron = [
   # Every day at 1am
   {"0 1 * * *", Plausible.Workers.CleanInvitations},
   # Every 2 hours
+  {"30 */2 * * *", Plausible.Workers.CleanUserSessions},
+  # Every 2 hours
   {"0 */2 * * *", Plausible.Workers.ExpireDomainChangeTransitions},
   # Daily at midnight
   {"0 0 * * *", Plausible.Workers.LocationsSync}
@@ -619,6 +621,7 @@ base_queues = [
   check_stats_emails: 1,
   site_setup_emails: 1,
   clean_invitations: 1,
+  clean_user_sessions: 1,
   analytics_imports: 1,
   analytics_exports: 1,
   notify_exported_analytics: 1,
diff --git a/lib/workers/clean_user_sessions.ex b/lib/workers/clean_user_sessions.ex
new file mode 100644
index 0000000000000..3b459facb8754
--- /dev/null
+++ b/lib/workers/clean_user_sessions.ex
@@ -0,0 +1,24 @@
+defmodule Plausible.Workers.CleanUserSessions do
+  @moduledoc """
+  Job removing expired user sessions. A grace period is applied.
+  """
+
+  use Plausible.Repo
+  use Oban.Worker, queue: :clean_user_sessions
+
+  @grace_period Duration.new!(day: -7)
+
+  @impl Oban.Worker
+  def perform(_job) do
+    grace_cutoff =
+      NaiveDateTime.utc_now(:second)
+      |> NaiveDateTime.shift(@grace_period)
+
+    Repo.delete_all(
+      from us in Plausible.Auth.UserSession,
+        where: us.timeout_at < ^grace_cutoff
+    )
+
+    :ok
+  end
+end