diff --git a/playbooks/roles/gerrit/tasks/main.yaml b/playbooks/roles/gerrit/tasks/main.yaml
index ba443a882b..db7a8c400b 100644
--- a/playbooks/roles/gerrit/tasks/main.yaml
+++ b/playbooks/roles/gerrit/tasks/main.yaml
@@ -349,6 +349,8 @@
 
 # Gerrit rotates their own logs, but doesn't clean them out
 # Delete logs older than a month
+# TODO set state to absent then remove entirely after we upgrade to
+# Gerrit 3.10 and set log.timeToKeep to do this rotation natively.
 - name: Set up cron job to clean old gerrit logs
   cron:
     name: clear-gerrit-logs
diff --git a/playbooks/roles/gerrit/templates/gerrit.config.j2 b/playbooks/roles/gerrit/templates/gerrit.config.j2
index 759a7c68a7..b989115a8d 100644
--- a/playbooks/roles/gerrit/templates/gerrit.config.j2
+++ b/playbooks/roles/gerrit/templates/gerrit.config.j2
@@ -42,6 +42,10 @@
 	javaHome = /usr/lib/jvm/java-17-openjdk-amd64
 	javaOptions = "-Dflogger.backend_factory=com.google.common.flogger.backend.log4j.Log4jBackendFactory#getInstance"
 	javaOptions = "-Dflogger.logging_context=com.google.gerrit.server.logging.LoggingContext#getInstance"
+[log]
+	rotate = true
+	compress = true
+	timeToKeep = 30d
 [gc]
 [core]
 	packedGitOpenFiles = {{ gerrit_packed_git_open_files }}