diff --git a/pkg/zones/zone_rings.go b/pkg/zones/zone_rings.go
new file mode 100644
index 0000000..8eff196
--- /dev/null
+++ b/pkg/zones/zone_rings.go
@@ -0,0 +1,17 @@
+package zones
+
+// PruneWireguardConfig removes wgN.conf files of machines with
+// the corresponding ring disabled.
+func (z *Zone) PruneWireguardConfig(ring int) error {
+	var err error
+
+	z.ForEachMachine(func(p *Machine) bool {
+		_, ok := p.getRingInfo(ring)
+		if !ok {
+			err = p.RemoveWireguardConfig(ring)
+		}
+		return err != nil
+	})
+
+	return err
+}