diff --git a/lib/syslog-server-stack.ts b/lib/syslog-server-stack.ts
index ae2528d..b6a23e8 100644
--- a/lib/syslog-server-stack.ts
+++ b/lib/syslog-server-stack.ts
@@ -115,6 +115,22 @@ export class SyslogServerStack extends cdk.Stack {
       "systemctl enable rsyslog",
       "systemctl restart rsyslog",
       "",
+      "# ── Rotate /var/log/remote so it can't grow unbounded ──",
+      "# CloudWatch (90d) is the system of record; these local files are just a",
+      "# spool for the CW agent, so keep only a short window. copytruncate keeps",
+      "# rsyslog's open dynaFile handles valid (truncate in place, same inode).",
+      "cat > /etc/logrotate.d/remote-syslog <<'EOF'",
+      "/var/log/remote/*/*.log {",
+      "    daily",
+      "    rotate 7",
+      "    compress",
+      "    delaycompress",
+      "    missingok",
+      "    notifempty",
+      "    copytruncate",
+      "}",
+      "EOF",
+      "",
       "# ── CloudWatch agent: ship /var/log/remote/**/*.log to unifi-syslog ──",
       "dnf install -y amazon-cloudwatch-agent",
       "cat > /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json <<'EOF'",