diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index f79bc5ea6d..5de4e88eed 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -25,7 +25,7 @@ default:
       - runner_system_failure
       - stuck_or_timeout_failure
   tags:
-    - veloren-build
+    - veloren/veloren
 
 # NOTE: overriden for the `.tmacos` template so relevant changes need to be mirrored there
 before_script:
diff --git a/.gitlab/CI/build.gitlab-ci.yml b/.gitlab/CI/build.gitlab-ci.yml
index e72b92f6ac..e5d2b57805 100644
--- a/.gitlab/CI/build.gitlab-ci.yml
+++ b/.gitlab/CI/build.gitlab-ci.yml
@@ -2,8 +2,7 @@ unittests:
   extends: .recompile-branch
   stage: build
   image: registry.gitlab.com/veloren/veloren-docker-ci/cache/quality:${CACHE_IMAGE_TAG}
-  tags:
-    - veloren-build
+  tags: ["veloren/veloren", "check"]
   variables:
     GIT_DEPTH: 9999999999999
   script:
@@ -17,6 +16,7 @@ translation:
   extends: .release
   stage: build
   image: registry.gitlab.com/veloren/veloren-docker-ci/cache/quality:${CACHE_IMAGE_TAG}
+  tags: ["veloren/veloren", "check"]
   script:
     - ln -s /dockercache/target target
     - cat ./.gitlab/scripts/translation.sh
@@ -36,8 +36,7 @@ benchmarks:
   extends: .release
   stage: build
   image: registry.gitlab.com/veloren/veloren-docker-ci/cache/bench:${CACHE_IMAGE_TAG}
-  tags:
-    - veloren-benchmark
+  tags: ["veloren/veloren", "check", "benchmark"]
   script:
     - unset DISABLE_GIT_LFS_CHECK
     - ln -s /dockercache/target target
@@ -60,8 +59,7 @@ coverage:
   extends: .release
   stage: build
   image: registry.gitlab.com/veloren/veloren-docker-ci/cache/tarpaulin:${CACHE_IMAGE_TAG}
-  tags:
-    - veloren-build
+  tags: ["veloren/veloren", "check"]
   script:
     - ln -s /dockercache/target target
     - cat ./.gitlab/scripts/coverage.sh
@@ -150,54 +148,57 @@ linux:
   extends:
     - .tlinux
     - .release
+  tags: ["veloren/veloren", "build", "publish", "trusted"]
 
 windows:
   extends:
     - .twindows
     - .release
+  tags: ["veloren/veloren", "build", "publish", "trusted"]
 
 macos:
   extends:
     - .tmacos
     - .release
     - .tmacos-master-cache
+  tags: ["veloren/veloren:macos", "build", "publish", "trusted"]
 
 # build on schedule quickfix till airshipper 0.5
 air-linux:
   extends:
     - .tlinux
     - .release-nightly-tmp-fix-airshipper
-  tags:
-    - veloren-publish
+  tags: ["veloren/veloren", "build", "publish", "trusted"]
 
 air-windows:
   extends:
     - .twindows
     - .release-nightly-tmp-fix-airshipper
-  tags:
-    - veloren-publish
+  tags: ["veloren/veloren", "build", "publish", "trusted"]
 
 air-macos:
   extends:
     - .tmacos
     - .release-nightly-tmp-fix-airshipper
     - .tmacos-master-cache
-  tags:
-    - veloren-publish
+  tags: ["veloren/veloren:macos", "build", "publish", "trusted"]
 
 # if NOT release or master, allow optional builds
 opt-linux:
   extends:
     - .tlinux
     - .optional-release
+  tags: ["veloren/veloren", "build"]
 
 opt-windows:
   extends:
     - .twindows
     - .optional-release
+  tags: ["veloren/veloren", "build"]
 
 opt-macos:
   extends:
     - .tmacos
     - .optional-release
     - .tmacos-mr-cache
+  tags: ["veloren/veloren:macos", "build"]
diff --git a/.gitlab/CI/check.gitlab-ci.yml b/.gitlab/CI/check.gitlab-ci.yml
index 13dadd1948..ad23e01a9e 100644
--- a/.gitlab/CI/check.gitlab-ci.yml
+++ b/.gitlab/CI/check.gitlab-ci.yml
@@ -3,8 +3,7 @@ code-quality:
   extends: .recompile-branch
   stage: check
   image: registry.gitlab.com/veloren/veloren-docker-ci/cache/quality:${CACHE_IMAGE_TAG}
-  tags:
-    - veloren-build
+  tags: ["veloren/veloren", "check"]
   script:
     - ln -s /dockercache/target target
     - cat ./.gitlab/scripts/code-quality.sh
@@ -14,8 +13,7 @@ security:
   extends: .recompile-branch
   stage: check
   image: registry.gitlab.com/veloren/veloren-docker-ci/cache/quality:${CACHE_IMAGE_TAG}
-  tags:
-    - veloren-build
+  tags: ["veloren/veloren", "check"]
   allow_failure: true
   script:
     - ln -s /dockercache/target target
diff --git a/.gitlab/CI/publish.gitlab-ci.yml b/.gitlab/CI/publish.gitlab-ci.yml
index ae79d29aab..a277f71893 100644
--- a/.gitlab/CI/publish.gitlab-ci.yml
+++ b/.gitlab/CI/publish.gitlab-ci.yml
@@ -19,6 +19,7 @@ docker:
   image:
     name: gcr.io/kaniko-project/executor:debug
     entrypoint: [""]
+  tags: ["veloren/veloren", "publish", "trusted"]
   dependencies:
     - linux
   before_script:
@@ -35,8 +36,7 @@ docker-nightly:
   image:
     name: gcr.io/kaniko-project/executor:debug
     entrypoint: [""]
-  tags:
-    - veloren-publish
+  tags: ["veloren/veloren", "publish", "trusted"]
   dependencies:
     - air-linux
   before_script:
@@ -51,8 +51,7 @@ docker-nightly:
 tag-nightly:
   extends: .publish-nightly
   image: registry.gitlab.com/veloren/veloren-docker-ci/cache/quality:${CACHE_IMAGE_TAG}
-  tags:
-    - veloren-benchmark
+  tags: ["veloren/veloren", "publish", "trusted"]
   script:
     - git config --global user.email "gitlab-veloren-bot@veloren.net"
     - git config --global user.name "veloren-bot"
@@ -64,6 +63,7 @@ tag-nightly:
 pages:
   extends: .publish
   image: registry.gitlab.com/veloren/veloren-docker-ci/cache/quality:${CACHE_IMAGE_TAG}
+  tags: ["veloren/veloren", "publish"]
   artifacts:
     paths:
       - public