diff --git a/CHANGELOG.md b/CHANGELOG.md
index b16a1e0a..992cdd66 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,11 @@
 # Changelog
 All notable changes to this project will be documented in this file.
 
+## Unreleased
+
+### Improvements
+- Add the `prunetokenbucket` management command
+
 ## 1.7.0 - 2019-05-02
 
 ### Improvements
diff --git a/README.md b/README.md
index e77df3d3..8024bc0b 100644
--- a/README.md
+++ b/README.md
@@ -258,9 +258,9 @@ There are separate Django management commands for each task:
     ```
 
 * Remove user accounts that match either of these conditions:
- * Account was created more than 6 months ago, and user has never logged in.
+  * Account was created more than 6 months ago, and user has never logged in.
    These can happen when user enters invalid email address when signing up.
- * Last login was more than 6 months ago, and the account has no checks.
+  * Last login was more than 6 months ago, and the account has no checks.
    Assume the user doesn't intend to use the account any more and would
    probably *want* it removed.
 
@@ -268,6 +268,14 @@ There are separate Django management commands for each task:
     $ ./manage.py pruneusers
     ```
 
+* Remove old records fromt he `api_tokenbucket` table. The TokenBucket
+  model is used for rate-limiting login attempts and similar operations.
+  Any records older than one day can be safely removed.
+
+    ```
+    $ ./manage.py prunetokenbucket
+    ```
+
 When you first try these commands on your data, it is a good idea to
 test them on a copy of your database, not on the live database right away.
 In a production setup, you should also have regular, automated database
diff --git a/hc/api/management/commands/prunetokenbucket.py b/hc/api/management/commands/prunetokenbucket.py
new file mode 100644
index 00000000..23044a22
--- /dev/null
+++ b/hc/api/management/commands/prunetokenbucket.py
@@ -0,0 +1,17 @@
+from datetime import timedelta
+
+from django.core.management.base import BaseCommand
+from django.utils.timezone import now
+from hc.api.models import TokenBucket
+
+
+class Command(BaseCommand):
+    help = 'Prune pings based on limits in user profiles'
+
+    def handle(self, *args, **options):
+
+        day_ago = now() - timedelta(days=1)
+        q = TokenBucket.objects.filter(updated__lt=day_ago)
+        n_pruned, _ = q.delete()
+
+        return "Done! Pruned %d token bucket entries" % n_pruned