diff --git a/action.yaml b/action.yaml
index 992688f..5f2e5ad 100644
--- a/action.yaml
+++ b/action.yaml
@@ -65,9 +65,19 @@ runs:
         set -euo pipefail
         tea login add --name ci --url https://code.fritzlab.net \
           --token "$TOKEN" --no-version-check >/dev/null 2>&1 || true
-        tea api "/packages/${ORG}?type=container" \
-          | jq -r --arg n "$NAME" \
-              '.[] | select(.name==$n) | select(.version | test("^[0-9]+$")) | .version' \
+        # Paginate the package list. The org has more container versions than a
+        # single API page returns (Gitea caps page size at MAX_RESPONSE_ITEMS),
+        # so an unpaginated call silently drops a package's older tags from the
+        # list and they never get pruned — that's how tags crept past KEEP.
+        page=1
+        while :; do
+          resp=$(tea api "/packages/${ORG}?type=container&limit=50&page=${page}")
+          [ "$(jq 'length' <<<"$resp")" -eq 0 ] && break
+          jq -r --arg n "$NAME" \
+            '.[] | select(.name==$n) | select(.version | test("^[0-9]+$")) | .version' \
+            <<<"$resp"
+          page=$((page + 1))
+        done \
           | sort -n | head -n -"$KEEP" \
           | while read -r tag; do
               echo "deleting ${NAME}:$tag"