diff --git a/ops/nixos/lib/low-space.nix b/ops/nixos/lib/low-space.nix
new file mode 100644
index 0000000000..6edcbfabdc
--- /dev/null
+++ b/ops/nixos/lib/low-space.nix
@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+{ pkgs, depot, lib, ... }:
+in
+{
+  config = {
+    services.journald.extraConfig = lib.mkAfter ''
+      SystemMaxUse=50M
+    '';
+  };
+}
diff --git a/ops/nixos/marukuru/default.nix b/ops/nixos/marukuru/default.nix
index 4791e1e157..37c3187c45 100644
--- a/ops/nixos/marukuru/default.nix
+++ b/ops/nixos/marukuru/default.nix
@@ -6,7 +6,10 @@
 let
   inherit (depot.ops) secrets;
 in {
-  imports = [ ../../../third_party/nixpkgs/nixos/modules/profiles/qemu-guest.nix ];
+  imports = [
+    ../../../third_party/nixpkgs/nixos/modules/profiles/qemu-guest.nix
+    ../lib/low-space.nix
+  ];
   boot.kernelModules = [ "tcp_bbr" ];
   boot.kernel.sysctl = {
     "net.ipv6.conf.default.accept_ra" = 1;
@@ -159,6 +162,9 @@ in {
 
   containers.deployer = {
     config = { config, pkgs, ... }: {
+      imports = [
+        ../lib/low-space.nix
+      ];
       networking.hosts = depot.ops.nixos.tailscaleIPs;
       nix = {
         binaryCaches = lib.mkForce [ "https://cache.nixos.org/" "s3://lukegb-nix-cache?endpoint=storage.googleapis.com&trusted=1" ];