diff --git a/.gitlab/deployment.yaml b/.gitlab/deployment.yaml
index ced0362..6352d03 100644
--- a/.gitlab/deployment.yaml
+++ b/.gitlab/deployment.yaml
@@ -7,11 +7,10 @@ deployment:
     name: "cr.simoncor.net/siempie/ansible-deployment:latest"
     entrypoint: ["/bin/sh", "-c"]
   rules:
-    - if: '$CI_PIPELINE_SOURCE == "push"'
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
-    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
-    - when: "never"
 
+    # run only on push to default branch
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+    - when: "never"
 
   # prepare ssh
   before_script:
@@ -25,7 +24,6 @@ deployment:
         echo "$SSH_DEPLOYMENT_KEY" > ~/.ssh/id_ed25519
         chmod 600 ~/.ssh/id_ed25519
 
-
   # deployment commands
   script:
 
diff --git a/.gitlab/linting.yaml b/.gitlab/linting.yaml
index 759cbee..01b8aa3 100644
--- a/.gitlab/linting.yaml
+++ b/.gitlab/linting.yaml
@@ -7,8 +7,9 @@ linting:
     name: "cr.simoncor.net/siempie/ansible-deployment:latest"
     entrypoint: ["/bin/sh", "-c"]
   rules:
-    - if: '$CI_PIPELINE_SOURCE == "push"'
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+
+    # run only on push to default branch
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
     - when: "never"
 
   # start linting