diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index bdc2e47..1b9823a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -41,7 +41,7 @@ update:
       - $UPDATE_FLAKE == "yes"
 
 # every commit on main will build and deploy
-.build_template: &build
+.build_template: &builder
   tags:
     - nix
   before_script:
@@ -54,8 +54,6 @@ update:
     - . "$HOME/.nix-profile/etc/profile.d/nix.sh"
     - git pull origin main
   only:
-    refs:
-      - main
     changes:
       - applications/**/*
       - machines/**/*
@@ -63,21 +61,29 @@ update:
       - flake.*
       - .gitlab-ci.yml
 
+# deploy items only run on main
+.deploy_template: &deployment
+  only:
+    refs:
+      - main
+
 build:
-  <<: *build
+  <<: *builder
   stage: test
   script:
     - nix --experimental-features 'nix-command flakes' run nixpkgs#colmena -- build
 
 # dns always has to be deployed first
 deploy_dns:
-  <<: *build
+  <<: *builder
+  <<: *deployment
   stage: deploy
   script:
     - nix --experimental-features 'nix-command flakes' run nixpkgs#colmena -- apply --on @active-dns
 
 deploy_core:
-  <<: *build
+  <<: *builder
+  <<: *deployment
   stage: deploy
   needs:
     - deploy_dns
@@ -85,7 +91,8 @@ deploy_core:
     - nix --experimental-features 'nix-command flakes' run nixpkgs#colmena -- apply --on @active-core
 
 deploy_active:
-  <<: *build
+  <<: *builder
+  <<: *deployment
   stage: deploy
   needs:
     - deploy_dns
@@ -93,7 +100,8 @@ deploy_active:
     - nix --experimental-features 'nix-command flakes' run nixpkgs#colmena -- apply --on @active
 
 deploy_gitlab:
-  <<: *build
+  <<: *builder
+  <<: *deployment
   stage: deploy_gitlab
   script:
     - nix --experimental-features 'nix-command flakes' run nixpkgs#colmena -- apply --on @active-gitlab