diff --git a/services/metabase/.gitignore b/services/metabase/.gitignore
index a0120e09..49f07dbc 100644
--- a/services/metabase/.gitignore
+++ b/services/metabase/.gitignore
@@ -1,2 +1,3 @@
 configure_metabase.sql
+remove_metabase.sql
 docker-compose.yml
diff --git a/services/metabase/Makefile b/services/metabase/Makefile
index 9a17535d..3e0a0caa 100644
--- a/services/metabase/Makefile
+++ b/services/metabase/Makefile
@@ -28,3 +28,7 @@ docker-compose.yml: docker-compose.yml.j2 .env venv
 configure_metabase.sql: .env
 	@set -o allexport; source $<; set +o allexport; \
 	envsubst < $@.template > $@
+
+remove_metabase.sql: .env
+	@set -o allexport; source $<; set +o allexport; \
+	envsubst < $@.template > $@
diff --git a/services/metabase/README.md b/services/metabase/README.md
index 53960de1..855c8f70 100644
--- a/services/metabase/README.md
+++ b/services/metabase/README.md
@@ -7,6 +7,11 @@ Before deploying metabase first time, make sure that postgres is configured:
 
 This can be automated via https://github.com/ITISFoundation/osparc-ops-environments/issues/827
 
+## Removing metabase from deployment
+1. Remove stack from CI pipelines
+2. Manually delete stack
+3. Clean up database with sql scripts (generated via metabase's Makefile)
+
 ## Extra Configuration (optional)
 
 Setting up email (manual):
diff --git a/services/metabase/remove_metabase.sql.template b/services/metabase/remove_metabase.sql.template
new file mode 100644
index 00000000..217eab01
--- /dev/null
+++ b/services/metabase/remove_metabase.sql.template
@@ -0,0 +1,15 @@
+-- need to be executed while connected as ${METABASE_POSTGRES_USER} user
+DROP DATABASE ${METABASE_POSTGRES_DB};
+
+/*
+need to be executed while connected to ${POSTGRES_DB} database
+as ${POSTGRES_USER} user
+*/
+
+REVOKE SELECT ON TABLE ${METABASE_POSTGRES_ALLOWED_SIMCORE_TABLES} FROM ${METABASE_POSTGRES_USER};
+
+REVOKE USAGE ON SCHEMA public FROM ${METABASE_POSTGRES_USER};
+
+REVOKE CONNECT ON DATABASE ${POSTGRES_DB} FROM ${METABASE_POSTGRES_USER};
+
+DROP USER ${METABASE_POSTGRES_USER};