diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 3e03fdf12855a12daa34c36dac8b08a0264f128e..cfe84c712c8cba9ccf358431cfc4ddb01b6d6922 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -26,7 +26,6 @@ variables:
       - 'terraform/environments/terraform-*.log' # separate log for every step/command
       - $API_DOMAIN_PATH
     name: '${CI_JOB_NAME}_${CI_JOB_ID}'
-    #when: on_failure
     expire_in: 1 week
   script:
     - terraform/environments/scripts/create-or-update-env.sh "$ENVIRONMENT_ID" "$CI_COMMIT_SHA"
@@ -96,18 +95,20 @@ review_deploy:
     url: https://$CI_ENVIRONMENT_SLUG.goodnews.apis.holi.social
     on_stop: review_destroy
     auto_stop_in: 1 week
-  except:
-    - main
-    - production
-    - /^noenv\/.*/
+  rules:
+    - if: $CI_COMMIT_BRANCH =~ /^main$|^noenv\/.*/
+      when: never
+    - if: $CI_COMMIT_BRANCH
+      when: on_success
 
 review_smoketest:
   extends: .smoketest
   needs: ['review_deploy']
-  except:
-    - main
-    - production
-    - /^noenv\/.*/
+  rules:
+    - if: $CI_COMMIT_BRANCH =~ /^main$|^noenv\/.*/
+      when: never
+    - if: $CI_COMMIT_BRANCH
+      when: on_success
 
 review_destroy:
   needs: ['review_deploy']
@@ -135,13 +136,12 @@ review_destroy:
     - git clone "$CI_REPOSITORY_URL" main-clone
     - cd main-clone
     - terraform/environments/scripts/destroy-env.sh "$CI_ENVIRONMENT_SLUG"
-  # can't use rules here: https://gitlab.com/gitlab-org/gitlab/-/issues/34077
-  when: manual
   allow_failure: true
-  except:
-    - main
-    - production
-    - /^noenv\/.*/
+  rules:
+    - if: $CI_COMMIT_BRANCH =~ /^main$|^noenv\/.*/
+      when: never
+    - if: $CI_COMMIT_BRANCH
+      when: manual
   resource_group: $ENVIRONMENT_ID # never execute terraform in parallel on the same environment
   interruptible: false
 
@@ -156,14 +156,16 @@ staging_deploy:
     url: https://staging.goodnews.apis.holi.social
   variables:
     ENVIRONMENT_ID: staging
-  only:
-    - main
+  rules:
+    - if: $CI_COMMIT_BRANCH == 'main'
+      when: on_success
 
 staging_smoketest:
   extends: .smoketest
   needs: ['staging_deploy']
-  only:
-    - main
+  rules:
+    - if: $CI_COMMIT_BRANCH == 'main'
+      when: on_success
   resource_group: unified-api-staging
 
 staging_trigger_unified-api_redeployment:
@@ -171,14 +173,15 @@ staging_trigger_unified-api_redeployment:
   trigger:
     project: 'app/holi-unified-api'
     branch: 'main'
-  only:
-    - main
+  rules:
+    - if: $CI_COMMIT_BRANCH == 'main'
+      when: on_success
 
 ## production environment
 
 production_deploy:
   extends: .deploy
-  needs: ['build_docker']
+  needs: ['staging_smoketest']
   allow_failure: false
   environment:
     name: production
@@ -186,20 +189,23 @@ production_deploy:
     url: https://production.goodnews.apis.holi.social
   variables:
     ENVIRONMENT_ID: production
-  only:
-    - production
+  rules:
+    - if: $CI_COMMIT_BRANCH == 'main'
+      when: on_success
 
 production_smoketest:
   extends: .smoketest
   needs: ['production_deploy']
-  only:
-    - production
+  rules:
+    - if: $CI_COMMIT_BRANCH == 'main'
+      when: on_success
 
 production_trigger_unified-api_redeployment:
   needs: ['production_smoketest']
   trigger:
     project: 'app/holi-unified-api'
     branch: 'production'
-  only:
-    - production
+  rules:
+    - if: $CI_COMMIT_BRANCH == 'main'
+      when: on_success
   resource_group: unified-api-production