diff --git a/config.nix b/config.nix
index 3eaa193..a717aa9 100644
--- a/config.nix
+++ b/config.nix
@@ -1,4 +1,5 @@
 {
+  allowAliases = false;
   allowUnfree = true;
   # allowInsecure = true;
   # allowBroken = true;
diff --git a/justfile b/justfile
index a886aa0..eca78dd 100644
--- a/justfile
+++ b/justfile
@@ -927,6 +927,7 @@ fix-periodic-merge-conflict $from=`just _a_upstream_release_branch "From?"` $to=
 # setup or update master and staging++
 setup:
     #!/usr/bin/env -S bash -euo pipefail
+    verbose() ( set -x; "$@"; )
     if [[ ! -e master/.git ]]; then
         gh_user=$(gum input \
             --header "git clone git@github.com:< username >/nixpkgs.git" \
@@ -943,33 +944,42 @@ setup:
     fi
     cd master
     if ! $GIT remote get-url upstream >&/dev/null; then
-        (set -x; $GIT remote add upstream "https://github.com/NixOS/nixpkgs.git")
+        verbose $GIT remote add upstream "https://github.com/NixOS/nixpkgs.git"
     fi
     # TODO: check the mtime on the HEAD file instead?
     if [[ $(( "$epoch" - "$($GIT log --oneline --format="%ct" HEAD -n1)" )) -gt $(( 60*60*24 )) ]]; then
-        (set -x; $GIT pull --rebase --autostash upstream master >&2)
+        verbose $GIT pull --rebase --autostash upstream master >&2
     fi
     add_upstream() (
         local branch="$1"
         if [[ ! -d ../upstream/"$branch" ]]; then
-            set -x
-            $GIT fetch upstream "$branch"
-            $GIT worktree add ../upstream/"$branch" -B "upstream-$branch" upstream/"$branch"
+            verbose $GIT fetch upstream "$branch"
+            verbose $GIT worktree add ../upstream/"$branch" -B "upstream-$branch" upstream/"$branch"
         else
             cd ../upstream/"$branch"
             if [[ $(( "$epoch" - "$($GIT log --oneline --format="%ct" HEAD -n1)" )) -gt $(( 60*60*24 )) ]]; then
-                set -x
-                $GIT pull --rebase --autostash upstream "$branch" >&2
+                verbose $GIT pull --rebase --autostash upstream "$branch" >&2
             fi
         fi
     )
+    # add new upstreams
     declare -a branches=()
     readarray -td $'\n' branches < <( just _list_upstream_release_branches "" "" )
-    # TODO: clean old release branches
     for branch in "${branches[@]}"; do
         add_upstream "$branch"
     done
 
+    # remove eol upstreams
+    declare -a branches=()
+    readarray -td $'\n' branches < <( just _list_eol_upstream_release_branches "" "" )
+    for branch in "${branches[@]}"; do
+        if [[ -e ../upstream/"$branch"/.git ]]; then
+            verbose rm -rf ../upstream/"$branch"
+        fi
+    done
+
+    verbose $GIT worktree prune
+
 clean:
     #!/usr/bin/env -S bash -euo pipefail
     cleanlist="$(just _mk_clean_list)" || exit 1
@@ -1520,13 +1530,20 @@ _some_prs:
 
 @_list_upstream_release_branches $prefix="upstream/" $suffix="":
     printf "${prefix//%/%%}%s${suffix//%/%%}\n" \
-        master \
-        staging \
-        staging-next \
+        master staging staging-next \
         python-updates \
-        release-25.05 \
-        staging-25.05 \
-        staging-next-25.05
+        release-25.05 staging-25.05 staging-next-25.05
+
+@_list_eol_upstream_release_branches $prefix="upstream/" $suffix="":
+    printf "${prefix//%/%%}%s${suffix//%/%%}\n" \
+        release-24.11 staging-24.11 staging-next-24.11 \
+        release-24.05 staging-24.05 staging-next-24.05 \
+        release-23.11 staging-23.11 staging-next-23.11 \
+        release-23.05 staging-23.05 staging-next-23.05 \
+        release-22.11 staging-22.11 staging-next-22.11 \
+        release-22.05 staging-22.05 staging-next-22.05 \
+        release-21.11 staging-21.11 staging-next-21.11 \
+        release-21.05 staging-21.05 staging-next-21.05
 
 @_a_upstream_release_branch $header *extra_branches:
     gum filter --header="$header" "${@:2}" $(just _list_upstream_release_branches "${prefix:-upstream/}" "${suffix:-}")