3 files changed, 20 insertions, 3 deletions
diff --git a/app/models/ci/pipeline_schedule.rb b/app/models/ci/pipeline_schedule.rb
index 49d27053745..eaef5608ad9 100644
--- a/app/models/ci/pipeline_schedule.rb
+++ b/app/models/ci/pipeline_schedule.rb
@@ -31,6 +31,7 @@ module Ci
     scope :inactive, -> { where(active: false) }
     scope :preloaded, -> { preload(:owner, project: [:route]) }
     scope :owned_by, ->(user) { where(owner: user) }
+    scope :for_project, ->(project_id) { where(project_id: project_id) }
 
     accepts_nested_attributes_for :variables, allow_destroy: true
 
diff --git a/app/models/user.rb b/app/models/user.rb
index dca6570661e..3e62b755f33 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -500,8 +500,11 @@ class User < MainClusterwide::ApplicationRecord
     # rubocop: disable CodeReuse/ServiceClass
     after_transition any => :blocked do |user|
       user.run_after_commit do
-        Ci::DropPipelineService.new.execute_async_for_all(user.pipelines, :user_blocked, user)
-        Ci::DisableUserPipelineSchedulesService.new.execute(user)
+        Ci::DropPipelinesAndDisableSchedulesForUserService.new.execute(
+          user,
+          reason: :user_blocked,
+          include_owned_projects_and_groups: false
+        )
       end
     end
 
@@ -512,11 +515,23 @@ class User < MainClusterwide::ApplicationRecord
         NotificationService.new.user_deactivated(user.name, user.notification_email_or_default)
       end
     end
-    # rubocop: enable CodeReuse/ServiceClass
 
     after_transition active: :banned do |user|
       user.create_banned_user
+
+      if Gitlab.com? # rubocop:disable Gitlab/AvoidGitlabInstanceChecks -- this is always necessary on GitLab.com
+        user.run_after_commit do
+          deep_clean_ci = user.custom_attributes.by_key(UserCustomAttribute::DEEP_CLEAN_CI_USAGE_WHEN_BANNED).exists?
+
+          Ci::DropPipelinesAndDisableSchedulesForUserService.new.execute(
+            user,
+            reason: :user_banned,
+            include_owned_projects_and_groups: deep_clean_ci
+          )
+        end
+      end
     end
+    # rubocop: enable CodeReuse/ServiceClass
 
     after_transition banned: :active do |user|
       user.banned_user&.destroy
diff --git a/app/models/user_custom_attribute.rb b/app/models/user_custom_attribute.rb
index d294ea49352..8d82910d29a 100644
--- a/app/models/user_custom_attribute.rb
+++ b/app/models/user_custom_attribute.rb
@@ -24,6 +24,7 @@ class UserCustomAttribute < ApplicationRecord
   DELETED_OWN_ACCOUNT_AT = 'deleted_own_account_at'
   SKIPPED_ACCOUNT_DELETION_AT = 'skipped_account_deletion_at'
   ASSUMED_HIGH_RISK_REASON = 'assumed_high_risk_reason'
+  DEEP_CLEAN_CI_USAGE_WHEN_BANNED = 'deep_clean_ci_usage_when_banned'
 
   class << self
     def upsert_custom_attributes(custom_attributes)