diff --git a/README.md b/README.md
index f9eb75a..0b7fca7 100644
--- a/README.md
+++ b/README.md
@@ -121,6 +121,14 @@ Community actions that build on top of `setup-tessl`:
 | --------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
 | [tesslio/patch-version-publish](https://github.com/tesslio/patch-version-publish) | Publish plugins with automatic patch version bumping — queries the registry for the latest version, bumps patch, publishes, and commits the updated `.tessl-plugin/plugin.json` back. Respects manual version bumps. | Use instead of `setup-tessl` + `tessl plugin publish`. It includes `setup-tessl` internally. |
 
+## Cleanup
+
+At job completion, the action automatically runs `tessl logout` on a
+best-effort basis, clearing on-disk Tessl credentials (such as
+`~/.tessl/llm-key.json`) so they do not persist on self-hosted or otherwise
+persistent runners. This teardown never fails the job — if the CLI is missing
+or there is nothing to clear, it is a harmless no-op.
+
 ## License
 
 MIT
diff --git a/action.yml b/action.yml
index 181c5d9..7970c85 100644
--- a/action.yml
+++ b/action.yml
@@ -109,3 +109,6 @@ runs:
       run: |
         echo "::add-mask::${TESSL_TOKEN}"
         echo "TESSL_TOKEN=${TESSL_TOKEN}" >> "$GITHUB_ENV"
+
+    - name: Register Tessl logout for job completion
+      uses: ./logout
diff --git a/logout/action.yml b/logout/action.yml
new file mode 100644
index 0000000..c530341
--- /dev/null
+++ b/logout/action.yml
@@ -0,0 +1,6 @@
+name: Tessl logout (post)
+description: Logs the Tessl CLI out of the runner at job completion (best effort).
+runs:
+  using: node20
+  main: main.js
+  post: post.js
diff --git a/logout/main.js b/logout/main.js
new file mode 100644
index 0000000..38954d9
--- /dev/null
+++ b/logout/main.js
@@ -0,0 +1 @@
+// no-op: logout runs in the post step
diff --git a/logout/post.js b/logout/post.js
new file mode 100644
index 0000000..3219bc4
--- /dev/null
+++ b/logout/post.js
@@ -0,0 +1,15 @@
+const { spawnSync } = require("node:child_process");
+
+const result = spawnSync("tessl", ["logout"], { stdio: "inherit" });
+
+if (result.error) {
+  if (result.error.code === "ENOENT") {
+    console.log("tessl binary not found; skipping logout");
+  } else {
+    console.log(`Tessl logout (best effort) failed to start: ${result.error.message}`);
+  }
+} else if (result.status !== 0) {
+  console.log(`Tessl logout (best effort) exited with code ${result.status}`);
+}
+
+process.exit(0);