diff --git a/server/index.ts b/server/index.ts
index 7f55be5..b3f44c0 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -2,6 +2,7 @@ import { Hono } from 'hono';
 import { serveStatic } from 'hono/bun';
 import { getDb } from './db';
 import { authRoutes } from './auth';
+import { gcSessions } from './session';
 import { activitiesRoutes } from './activities';
 import { tagsRoutes } from './tags';
 import { usersRoutes } from './users';
@@ -75,6 +76,15 @@ if (process.env.NODE_ENV === 'production') {
 
 const port = parseInt(process.env.PORT ?? '3000', 10);
 
+// Sweep expired sessions periodically so the table doesn't grow without
+// bound on instances with low signup volume (signup was previously the only
+// trigger). Hourly is plenty — session expiry is at day granularity. Tests
+// import individual route modules instead of this file, so the interval
+// only fires in a real server boot.
+const SESSION_GC_INTERVAL_MS = 60 * 60 * 1000;
+gcSessions();
+setInterval(gcSessions, SESSION_GC_INTERVAL_MS).unref();
+
 export default {
   port,
   fetch: app.fetch,