diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 696538e..319bd66 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -48,11 +48,11 @@ sync_repos:
     - chmod +x ./sync.sh
     - ./sync.sh
   rules:
+    - if: $UPDATE_FLAKE == "yes"
+      when: never
     - if: '$CI_PROJECT_NAMESPACE == "compsoc1/skynet" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
       changes:
         - sync/repos.csv
-    - if: $UPDATE_FLAKE == "yes"
-      when: never
 
 .scripts_base: &scripts_base
   # load nix environment
@@ -79,6 +79,8 @@ sync_repos:
     - *scripts_base
     - *scripts_cache
   rules:
+    - if: $UPDATE_FLAKE == "yes"
+      when: never
     - changes:
       - applications/**/*
       - machines/**/*
@@ -86,8 +88,6 @@ sync_repos:
       - flake.*
       - .gitlab-ci.yml
       - config/**/*
-    - if: $UPDATE_FLAKE == "yes"
-      when: never
 
 # deploy items only run on main
 .deploy_template: &deployment
@@ -96,6 +96,8 @@ sync_repos:
     - *scripts_base
     - *scripts_cache
   rules:
+    - if: $UPDATE_FLAKE == "yes"
+      when: never
     - if: '$CI_PROJECT_NAMESPACE == "compsoc1/skynet" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
       changes:
         - flake.nix
@@ -104,8 +106,6 @@ sync_repos:
         - machines/**/*
         - secrets/**/*
         - config/**/*
-    - if: $UPDATE_FLAKE == "yes"
-      when: never
 
 linter:
   <<: *builder