diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index fc84ea124e3..f45f3a457f1 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -195,8 +195,16 @@ include:
 .rules-anchors:
   # Pre-merge pipeline
   - &is-pre-merge '$CI_PIPELINE_SOURCE == "merge_request_event"'
+  # Push to a branch on a fork
+  - &is-fork-push '$CI_PROJECT_NAMESPACE != "mesa" && $CI_PIPELINE_SOURCE == "push"'
 
 
+# Rules applied to every job in the pipeline
+.common-rules:
+  rules:
+    - if: *is-fork-push
+      when: manual
+
 .never-post-merge-rules:
   rules:
     - if: *is-post-merge
@@ -205,6 +213,7 @@ include:
 
 .container+build-rules:
   rules:
+    - !reference [.common-rules, rules]
     # Run when re-enabling a disabled farm, but not when disabling it
     - !reference [.disable-farm-mr-rules, rules]
     # Never run immediately after merging, as we just ran everything
diff --git a/.gitlab-ci/test-source-dep.yml b/.gitlab-ci/test-source-dep.yml
index 6ee316d2801..8776762b955 100644
--- a/.gitlab-ci/test-source-dep.yml
+++ b/.gitlab-ci/test-source-dep.yml
@@ -48,6 +48,7 @@
 # ---------------------------------------------------------------
 .core-rules:
   rules:
+    - !reference [.common-rules, rules]
     - !reference [.no_scheduled_pipelines-rules, rules]
     - changes: &core_file_list
         - .gitlab-ci.yml
@@ -73,6 +74,7 @@
 .core-manual-rules:
   extends: .no-auto-retry
   rules:
+    - !reference [.common-rules, rules]
     # We only want manual jobs to show up when it's not marge's pre-merge CI
     # run, otherwise she'll wait until her timeout.  The exception is
     # performance jobs, see below.
diff --git a/docs/gitlab-ci.yml b/docs/gitlab-ci.yml
index b572a737393..d69fb702162 100644
--- a/docs/gitlab-ci.yml
+++ b/docs/gitlab-ci.yml
@@ -17,6 +17,7 @@ pages:
   extends: .docs-base
   stage: deploy
   rules:
+    - !reference [.common-rules, rules]
     - !reference [.no_scheduled_pipelines-rules, rules]
     - if: '$CI_PROJECT_NAMESPACE == "mesa" && $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH && $CI_COMMIT_BRANCH'
       changes: &docs-or-ci
@@ -36,6 +37,7 @@ test-docs:
   interruptible: true
   stage: deploy
   rules:
+    - !reference [.common-rules, rules]
     # pre-merge or merge pipeline
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
       changes: *docs-or-ci
@@ -52,6 +54,7 @@ linkcheck-docs:
   interruptible: true
   stage: deploy
   rules:
+    - !reference [.common-rules, rules]
     - !reference [.scheduled_pipeline-rules, rules]
   allow_failure: true
   script: