sudo apt-get autoremove --purge -y

autoremove deletes packages that became unneeded after upgrades or removals (dangling dependencies), and --purge also deletes their config files — a periodic hygiene step that frees disk and reduces attack surface. The -y flag skips the confirmation. It never touches explicitly installed packages, so it is safe after deploys.