diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 0c89ec45a2a..9934293b2df 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -18,28 +18,8 @@ stages:
 
 # When to automatically run the CI
 .ci-run-policy:
-  only:
-    refs:
-      - branches@mesa/mesa
-      - merge_requests
-      - /^ci([-/].*)?$/
-    changes:
-      - VERSION
-      - bin/**/*
-      # GitLab CI
-      - .gitlab-ci.yml
-      - .gitlab-ci/**/*
-      # Meson
-      - meson*
-      - build-support/**/*
-      - subprojects/**/*
-      # SCons
-      - SConstruct
-      - scons/**/*
-      - common.py
-      # Source code
-      - include/**/*
-      - src/**/*
+  rules:
+    - when: on_success
   retry:
     max: 2
     when:
@@ -77,6 +57,32 @@ stages:
   stage: container
   extends:
     - .ci-run-policy
+  rules:
+    # Run pipeline by default for merge requests changing files affecting it
+    - if: '$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME == $CI_COMMIT_REF_NAME'
+      changes:
+      - VERSION
+      - bin/**/*
+      # GitLab CI
+      - .gitlab-ci.yml
+      - .gitlab-ci/**/*
+      # Meson
+      - meson*
+      - build-support/**/*
+      - subprojects/**/*
+      # SCons
+      - SConstruct
+      - scons/**/*
+      - common.py
+      # Source code
+      - include/**/*
+      - src/**/*
+      when: on_success
+    # Always run pipeline by default in the main project
+    - if: '$CI_PROJECT_PATH == "mesa/mesa"'
+      when: on_success
+    # Otherwise, allow triggering jobs manually
+    - when: manual
   variables:
     DEBIAN_VERSION: buster-slim
     REPO_SUFFIX: $CI_JOB_NAME