diff --git a/services/blob/src/config.rs b/services/blob/src/config.rs
--- a/services/blob/src/config.rs
+++ b/services/blob/src/config.rs
@@ -1,5 +1,5 @@
 use anyhow::Result;
-use clap::Parser;
+use clap::{ArgAction, Parser};
 use once_cell::sync::Lazy;
 use tracing::info;
 
@@ -25,6 +25,10 @@
   #[arg(long, default_value = "http://localhost:50054")]
   pub identity_endpoint: String,
 
+  /// If set, blobs will be deleted instantly after revoking last holder
+  #[arg(long, global = true, action = ArgAction::SetTrue)]
+  pub instant_delete: bool,
+
   #[clap(subcommand)]
   pub command: Option<Command>,
 }
diff --git a/services/blob/src/main.rs b/services/blob/src/main.rs
--- a/services/blob/src/main.rs
+++ b/services/blob/src/main.rs
@@ -34,8 +34,15 @@
   let s3 = s3::S3Client::new(&aws_config);
   let auth_service = AuthService::new(&aws_config, &config.identity_endpoint);
 
-  let blob_service =
-    service::BlobService::new(db, s3, BlobServiceConfig::default());
+  let blob_service = service::BlobService::new(
+    db,
+    s3,
+    BlobServiceConfig {
+      instant_delete_orphaned_blobs: config.instant_delete,
+      // orphan_protection_period: chrono::Duration::milliseconds(1),
+      ..Default::default()
+    },
+  );
 
   match &config.command {
     Some(Command::Cleanup) => blob_service.perform_cleanup().await?,