diff --git a/ansible/roles/jenkins-workspace/files/clean_binary_tmp.sh b/ansible/roles/jenkins-workspace/files/clean_binary_tmp.sh
new file mode 100755
index 000000000..c2e587922
--- /dev/null
+++ b/ansible/roles/jenkins-workspace/files/clean_binary_tmp.sh
@@ -0,0 +1,17 @@
+#!/bin/bash -ex
+
+cd ~binary_tmp/binary_tmp.git
+(echo; date) >> ~binary_tmp/clean_binary_tmp.log
+du -sh ~binary_tmp/binary_tmp.git/ >> ~binary_tmp/clean_binary_tmp.log
+
+git fetch origin +master:master
+
+for b in $(git branch | sed /\*/d); do
+  if [ -z "$(git log -1 --since='7 days ago' -s $b)" ]; then
+    (git branch -D $b |& tee -a ~binary_tmp/clean_binary_tmp.log) || true
+  fi
+done
+
+git prune
+
+du -sh ~binary_tmp/binary_tmp.git/ >> ~binary_tmp/clean_binary_tmp.log
diff --git a/ansible/roles/jenkins-workspace/handlers/main.yml b/ansible/roles/jenkins-workspace/handlers/main.yml
new file mode 100644
index 000000000..537ceb6dd
--- /dev/null
+++ b/ansible/roles/jenkins-workspace/handlers/main.yml
@@ -0,0 +1,8 @@
+---
+
+#
+# generic handlers for jenkins-workspace stuff
+#
+
+- name: restart sshd
+  service: name="{{ sshd_service_name }}" state=restarted
diff --git a/ansible/roles/jenkins-workspace/tasks/main.yml b/ansible/roles/jenkins-workspace/tasks/main.yml
index fa4921157..774ec66a1 100644
--- a/ansible/roles/jenkins-workspace/tasks/main.yml
+++ b/ansible/roles/jenkins-workspace/tasks/main.yml
@@ -80,3 +80,29 @@
     owner: "binary_tmp"
     group: "binary_tmp"
     mode: 0755
+
+- name: Increase the maximum number of connections trying to authenticate
+  notify: restart sshd
+  lineinfile:
+    line: "MaxStartups 100:30:150"
+    dest: "{{ ssh_config }}"
+    regexp: "MaxStartups"
+
+- name: Create clean-up script
+  copy:
+    src: "{{ role_path }}/files/clean_binary_tmp.sh"
+    dest: "~binary_tmp/clean_binary_tmp.sh"
+    owner: "binary_tmp"
+    group: "binary_tmp"
+    mode: 0755
+
+- name: Schedule clean-up script to run daily
+  lineinfile:
+    line: "0 5	* * *	binary_tmp	~binary_tmp/clean_binary_tmp.sh"
+    dest: "/etc/crontab"
+    regexp: "clean_binary_tmp"
+
+- name: Disable automatic garbage collection
+  command: "git config gc.auto 0"
+  args:
+    chdir: "~binary_tmp/binary_tmp.git/"
diff --git a/ansible/roles/jenkins-workspace/vars/main.yml b/ansible/roles/jenkins-workspace/vars/main.yml
new file mode 100644
index 000000000..2392b769e
--- /dev/null
+++ b/ansible/roles/jenkins-workspace/vars/main.yml
@@ -0,0 +1,13 @@
+---
+
+#
+# variables for jenkins-workspace
+#
+
+ssh_config: /etc/ssh/sshd_config
+
+sshd_service_map: {
+  'ubuntu1604': 'ssh',
+}
+
+sshd_service_name: "{{ sshd_service_map[os]|default(sshd_service_map[os|stripversion])|default('sshd') }}"