diff --git a/.gitignore b/.gitignore
index cdf59bddf4370b7aa6d92b81805d866da31dc031..923c74121381a8d77989b2b92582383d8a0f0c3b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,3 +27,4 @@ core
 # don't accidentally commit the .envrc.local file
 /.run/_*
 .envrc.local
+terraform*.log
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 990d65de8e59538e3eb21840761ed5eef90e1fc5..aefee5a66f0173380754ead83fcbbdd2726e9cb2 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -168,6 +168,13 @@ review_destroy:
     name: review/$CI_COMMIT_REF_SLUG
     action: stop
   dependencies: [] # explicitly disable artifact usage
+  artifacts:
+    paths:
+      - "terraform/environments/crash.log" # optional, only available in case of a crash/panic
+      - "terraform/environments/terraform-*.log" # separate log for every step/command
+    name: "${CI_JOB_NAME}_${CI_JOB_ID}"
+    when: on_failure
+    expire_in: 1 week
   script:
     # branch may have been deleted, so we clone and checkout main
     - git clone $CI_REPOSITORY_URL main-clone
diff --git a/openbook_communities/schema/types.py b/openbook_communities/schema/types.py
index 2fa1384ee49c84458e11660b284ac5712970f754..d95c5a828b8ed7081f7e677100a46df451c93b6d 100644
--- a/openbook_communities/schema/types.py
+++ b/openbook_communities/schema/types.py
@@ -388,6 +388,17 @@ class Space:
 
         return Paged.of(appointments, offset, limit)
 
+    @strawberry_django.field()
+    def parent_space(self) -> Optional["Space"]:
+        """
+        We currently assume that a space can only have one parent.
+        There is no technical limitation for this, however, a Space can have multiple
+        different parent-child relationships/be part of different hierarchies.
+        """
+        return Community.objects.filter(
+            space_relationships__to_space=self, space_relationships__relationship_type=SpacesRelationshipType.PARENT_OF
+        ).first()
+
     @strawberry_django.field()
     def child_spaces(
         self, info, geolocation: Optional[GeoJSON] = None, offset: int = 0, limit: int = 10
diff --git a/terraform/environments/deployment.tf b/terraform/environments/deployment.tf
index 7248e59350b74130575813ac4f175c029377e2e3..8494274934f41d9ce08762355e2ee4e718c4722b 100644
--- a/terraform/environments/deployment.tf
+++ b/terraform/environments/deployment.tf
@@ -48,10 +48,10 @@ variable "image_tag" {
 # The job deployed by this resource is then triggered using the following null_resource definition every time a new image
 # will be deployed.
 resource "google_cloud_run_v2_job" "okuna_migration" {
-  project  = data.terraform_remote_state.holi_infra_state.outputs.shared_project_id
-  name     = "${random_id.main.hex}-migration"
-  location = local.default_region # finland, low CO2 emissions
-  # https://github.com/hashicorp/terraform-provider-google/issues/5898
+  project             = data.terraform_remote_state.holi_infra_state.outputs.shared_project_id
+  name                = "${random_id.main.hex}-migration"
+  location            = local.default_region # finland, low CO2 emissions
+  deletion_protection = false
 
   template {
     task_count = 1
diff --git a/terraform/environments/scripts/destroy-env.sh b/terraform/environments/scripts/destroy-env.sh
index 8feb7be2d8fb66fdc05c7485e05a4091b8f97396..d8137694745e9a6bcded13142bf6a5e666b55e6c 100755
--- a/terraform/environments/scripts/destroy-env.sh
+++ b/terraform/environments/scripts/destroy-env.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 
 # exit when any command fails
 set -ex
@@ -6,11 +6,36 @@ set -ex
 # enable debug output in terraform
 export TF_LOG=DEBUG
 
-cd terraform/environments
+# retry logic for destroy: sometimes, a full workspace destroy does not work. This can be due to e.g.:
+# * implicit dependencies between terraform resources not declared with depends_on,
+# * unclean shutdown of resources, e.g. service does not close db connections, db still sees clients connected,
+# * GCP stuff not allowing our resources to be deleted.
+# Most of the time, retrying a destroy fixes these causes.
+retry() {
+  for i in {1..3}; do
+    set +e
+    "$@"
+    retval=$?
+    set -e
+    if [ "$retval" -ne "0" ]; then
+      if [ "$i" -lt "3" ]; then
+        echo "command '$*' failed in try $i, retrying after 60 seconds"
+        sleep 60 # let things settle a bit
+      else
+        echo "command '$*' failed in try $i, giving up"
+        exit $retval
+      fi
+    else
+      break # success
+    fi
+  done
+}
+
+cd "$(dirname "$0")"/..
 
 TF_LOG_PATH=terraform-init.log       terraform init
 TF_LOG_PATH=terraform-version.log    terraform version
-TF_LOG_PATH=terraform-workspace.log  terraform workspace new "$1" || terraform workspace select "$1"
-TF_LOG_PATH=terraform-destroy.log    terraform destroy -auto-approve -var="image_tag=dummy"
+TF_LOG_PATH=terraform-workspace.log  terraform workspace select -or-create=true "$1"
+TF_LOG_PATH=terraform-destroy.log    retry terraform destroy -auto-approve -var="image_tag=dummy"
 TF_LOG_PATH=terraform-ws-default.log terraform workspace select default
 TF_LOG_PATH=terraform-ws-delete.log  terraform workspace delete "$1"