diff --git a/src/__phutil_library_map__.php b/src/__phutil_library_map__.php
--- a/src/__phutil_library_map__.php
+++ b/src/__phutil_library_map__.php
@@ -2188,6 +2188,7 @@
     'PhabricatorAuthAuthFactorPHIDType' => 'applications/auth/phid/PhabricatorAuthAuthFactorPHIDType.php',
     'PhabricatorAuthAuthProviderPHIDType' => 'applications/auth/phid/PhabricatorAuthAuthProviderPHIDType.php',
     'PhabricatorAuthChallenge' => 'applications/auth/storage/PhabricatorAuthChallenge.php',
+    'PhabricatorAuthChallengeGarbageCollector' => 'applications/auth/garbagecollector/PhabricatorAuthChallengeGarbageCollector.php',
     'PhabricatorAuthChallengePHIDType' => 'applications/auth/phid/PhabricatorAuthChallengePHIDType.php',
     'PhabricatorAuthChallengeQuery' => 'applications/auth/query/PhabricatorAuthChallengeQuery.php',
     'PhabricatorAuthChangePasswordAction' => 'applications/auth/action/PhabricatorAuthChangePasswordAction.php',
@@ -7830,6 +7831,7 @@
       'PhabricatorAuthDAO',
       'PhabricatorPolicyInterface',
     ),
+    'PhabricatorAuthChallengeGarbageCollector' => 'PhabricatorGarbageCollector',
     'PhabricatorAuthChallengePHIDType' => 'PhabricatorPHIDType',
     'PhabricatorAuthChallengeQuery' => 'PhabricatorCursorPagedPolicyAwareQuery',
     'PhabricatorAuthChangePasswordAction' => 'PhabricatorSystemAction',
diff --git a/src/applications/auth/garbagecollector/PhabricatorAuthChallengeGarbageCollector.php b/src/applications/auth/garbagecollector/PhabricatorAuthChallengeGarbageCollector.php
new file mode 100644
--- /dev/null
+++ b/src/applications/auth/garbagecollector/PhabricatorAuthChallengeGarbageCollector.php
@@ -0,0 +1,28 @@
+<?php
+
+final class PhabricatorAuthChallengeGarbageCollector
+  extends PhabricatorGarbageCollector {
+
+  const COLLECTORCONST = 'auth.challenges';
+
+  public function getCollectorName() {
+    return pht('Authentication Challenges');
+  }
+
+  public function hasAutomaticPolicy() {
+    return true;
+  }
+
+  protected function collectGarbage() {
+    $challenge_table = new PhabricatorAuthChallenge();
+    $conn = $challenge_table->establishConnection('w');
+
+    queryfx(
+      $conn,
+      'DELETE FROM %R WHERE challengeTTL < UNIX_TIMESTAMP() LIMIT 100',
+      $challenge_table);
+
+    return ($conn->getAffectedRows() == 100);
+  }
+
+}
diff --git a/src/applications/auth/storage/PhabricatorAuthChallenge.php b/src/applications/auth/storage/PhabricatorAuthChallenge.php
--- a/src/applications/auth/storage/PhabricatorAuthChallenge.php
+++ b/src/applications/auth/storage/PhabricatorAuthChallenge.php
@@ -25,6 +25,9 @@
         'key_issued' => array(
           'columns' => array('userPHID', 'challengeTTL'),
         ),
+        'key_collection' => array(
+          'columns' => array('challengeTTL'),
+        ),
       ),
     ) + parent::getConfiguration();
   }