diff --git a/src/garage/cli/remote/key.rs b/src/garage/cli/remote/key.rs
index 6faede01..67df9c48 100644
--- a/src/garage/cli/remote/key.rs
+++ b/src/garage/cli/remote/key.rs
@@ -21,6 +21,7 @@ impl Cli {
 			KeyOperation::Allow(query) => self.cmd_allow_key(query).await,
 			KeyOperation::Deny(query) => self.cmd_deny_key(query).await,
 			KeyOperation::Import(query) => self.cmd_import_key(query).await,
+			KeyOperation::DeleteExpired { yes } => self.cmd_delete_expired_keys(yes).await,
 		}
 	}
 
@@ -248,6 +249,29 @@ impl Cli {
 
 		Ok(())
 	}
+
+	pub async fn cmd_delete_expired_keys(&self, yes: bool) -> Result<(), Error> {
+		let mut list = self.api_request(ListKeysRequest).await?.0;
+
+		list.retain(|key| key.expired);
+
+		if !yes {
+			return Err(Error::Message(format!(
+				"This would delete {} access keys, add the --yes flag to proceed.",
+				list.len(),
+			)));
+		}
+
+		for key in list.iter() {
+			let id = key.id.clone();
+			println!("Deleting access key `{}` ({})", key.name, id);
+			self.api_request(DeleteKeyRequest { id }).await?;
+		}
+
+		println!("{} access keys have been deleted.", list.len());
+
+		Ok(())
+	}
 }
 
 fn print_key_info(key: &GetKeyInfoResponse) {
diff --git a/src/garage/cli/structs.rs b/src/garage/cli/structs.rs
index 7c00aefc..fadfcc66 100644
--- a/src/garage/cli/structs.rs
+++ b/src/garage/cli/structs.rs
@@ -430,6 +430,14 @@ pub enum KeyOperation {
 	/// Set parameters for an access key
 	#[structopt(name = "set", version = garage_version())]
 	Set(KeySetOpt),
+
+	/// Delete all expired access keys
+	#[structopt(name = "delete-expired", version = garage_version())]
+	DeleteExpired {
+		/// Confirm deletion
+		#[structopt(long = "yes")]
+		yes: bool,
+	},
 }
 
 #[derive(StructOpt, Debug)]