diff --git a/debian/authforge-daemon.postrm b/debian/authforge-daemon.postrm
new file mode 100755
index 0000000..2f1d29f
--- /dev/null
+++ b/debian/authforge-daemon.postrm
@@ -0,0 +1,24 @@
+#!/bin/sh
+# Cleans up state directories on purge. /etc/authforge/ holds policy
+# config; /var/lib/authforge/ holds runtime state (pending flags,
+# recovery hashes, TOTP secrets, userdb). Both are intentionally
+# preserved on plain remove — admin state survives a remove/install
+# round-trip, which matches Debian Policy §6.6 "Removing the package".
+set -e
+
+case "$1" in
+    purge)
+        rm -rf /etc/authforge
+        rm -rf /var/lib/authforge
+        ;;
+    remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+        ;;
+    *)
+        echo "postrm called with unknown argument \`$1'" >&2
+        exit 1
+        ;;
+esac
+
+#DEBHELPER#
+
+exit 0