diff --git a/services/core/java/com/android/server/pm/ApexManager.java b/services/core/java/com/android/server/pm/ApexManager.java
index d12e03d..c37ea8b 100644
--- a/services/core/java/com/android/server/pm/ApexManager.java
+++ b/services/core/java/com/android/server/pm/ApexManager.java
@@ -301,6 +301,14 @@
     public abstract boolean destroyDeSnapshots(int rollbackId);
 
     /**
+     * Deletes snapshots of the credential encrypted apex data directories for the specified user,
+     * where the rollback id is not included in {@code retainRollbackIds}.
+     *
+     * @return boolean true if the delete was successful
+     */
+    public abstract boolean destroyCeSnapshotsNotSpecified(int userId, int[] retainRollbackIds);
+
+    /**
      * Dumps various state information to the provided {@link PrintWriter} object.
      *
      * @param pw the {@link PrintWriter} object to send information to.
@@ -745,6 +753,17 @@
             }
         }
 
+        @Override
+        public boolean destroyCeSnapshotsNotSpecified(int userId, int[] retainRollbackIds) {
+            try {
+                mApexService.destroyCeSnapshotsNotSpecified(userId, retainRollbackIds);
+                return true;
+            } catch (Exception e) {
+                Slog.e(TAG, e.getMessage(), e);
+                return false;
+            }
+        }
+
         /**
          * Dump information about the packages contained in a particular cache
          * @param packagesCache the cache to print information about.
@@ -963,6 +982,11 @@
         }
 
         @Override
+        public boolean destroyCeSnapshotsNotSpecified(int userId, int[] retainRollbackIds) {
+            return true;
+        }
+
+        @Override
         void dump(PrintWriter pw, String packageName) {
             // No-op
         }
diff --git a/services/core/java/com/android/server/rollback/RollbackManagerServiceImpl.java b/services/core/java/com/android/server/rollback/RollbackManagerServiceImpl.java
index 42fada1..b50c22e 100644
--- a/services/core/java/com/android/server/rollback/RollbackManagerServiceImpl.java
+++ b/services/core/java/com/android/server/rollback/RollbackManagerServiceImpl.java
@@ -63,6 +63,7 @@
 import com.android.server.PackageWatchdog;
 import com.android.server.SystemConfig;
 import com.android.server.Watchdog;
+import com.android.server.pm.ApexManager;
 import com.android.server.pm.Installer;
 
 import java.io.File;
@@ -485,6 +486,8 @@
             }
 
             latch.countDown();
+
+            destroyCeSnapshotsForExpiredRollbacks(userId);
         });
 
         try {
@@ -495,6 +498,15 @@
     }
 
     @WorkerThread
+    private void destroyCeSnapshotsForExpiredRollbacks(int userId) {
+        int[] rollbackIds = new int[mRollbacks.size()];
+        for (int i = 0; i < rollbackIds.length; i++) {
+            rollbackIds[i] = mRollbacks.get(i).info.getRollbackId();
+        }
+        ApexManager.getInstance().destroyCeSnapshotsNotSpecified(userId, rollbackIds);
+    }
+
+    @WorkerThread
     private void updateRollbackLifetimeDurationInMillis() {
         mRollbackLifetimeDurationInMillis = DeviceConfig.getLong(
                 DeviceConfig.NAMESPACE_ROLLBACK_BOOT,