diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 621aee7f7..27d4310e0 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -58,11 +58,25 @@ include:
     ref: *template_sha
     file: '/templates/ci-fairy.yml'
 
+.default-rules:
+  rules:
+    # do not duplicate pipelines on merge pipelines
+    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS && $CI_PIPELINE_SOURCE == "push"
+      when: never
+    # we need a default case though, so all the rest still run
+    - when: on_success
+
+.merge-rules:
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      when: always
+    - when: never
 
 # Define the build stages. These are used for UI grouping as well as
 # dependencies.
 stages:
   - "Merge request checks"
+  - "Pre Base container"
   - "Base container"
   - "Full build and test"
   - "No-GL build and test"
@@ -86,19 +100,12 @@ stages:
     FDO_DISTRIBUTION_VERSION: bookworm
     FDO_DISTRIBUTION_EXEC: 'env FDO_CI_CONCURRENT=${FDO_CI_CONCURRENT} BUILD_ARCH=${BUILD_ARCH} KERNEL_IMAGE=${KERNEL_IMAGE} KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG} LLVM_VERSION=${LLVM_VERSION} FDO_DISTRIBUTION_VERSION=${FDO_DISTRIBUTION_VERSION} bash .gitlab-ci/debian-install.sh'
 
-.ci-rules:
-  rules:
-    - when: on_success
-
-# Does not inherit .ci-rules as we only want it to run in MR context.
+# Does not inherit .default-rules as we only want it to run in MR context.
 check-commit:
   extends:
     - .fdo.ci-fairy
+    - .merge-rules
   stage: "Merge request checks"
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
-      when: always
-    - when: never
   script:
     - ci-fairy check-commits --signed-off-by --junit-xml=results.xml
     - ci-fairy check-merge-request --require-allow-collaboration --junit-xml=results.xml
@@ -154,66 +161,87 @@ check-commit:
     KERNEL_DEFCONFIG: "defconfig"
     QEMU_SMP: 8 # built-in QEmu limit
 
+base-container-pre:
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      when: always
+    # default, only run by default on MR.
+    - when: manual
+  stage: "Pre Base container"
+  script: echo "exit 0"
+
 # Build our base container image, which contains the core distribution, the
 # toolchain, and all our build dependencies. This will be reused in the build
 # stage.
 x86_64-debian-lts-container_prep:
   extends:
-    - .ci-rules
+    - .default-rules
     - .debian-lts-x86_64
     - .fdo.container-build@debian
   timeout: 30m
+  needs:
+    - job: base-container-pre
   stage: "Base container"
 
 x86_64-debian-container_prep:
   extends:
-    - .ci-rules
+    - .default-rules
     - .debian-x86_64
     - .fdo.container-build@debian
+  needs:
+    - job: base-container-pre
   timeout: 30m
   stage: "Base container"
 
 armv7-debian-lts-container_prep:
   extends:
-    - .ci-rules
+    - .default-rules
     - .debian-lts-armv7
     - .fdo.container-build@debian
   tags:
     - aarch64
   variables:
     FDO_BASE_IMAGE: "arm32v7/debian:$FDO_DISTRIBUTION_VERSION"
+  needs:
+    - job: base-container-pre
   timeout: 30m
   stage: "Base container"
 
 armv7-debian-container_prep:
   extends:
-    - .ci-rules
+    - .default-rules
     - .debian-armv7
     - .fdo.container-build@debian
   tags:
     - aarch64
   variables:
     FDO_BASE_IMAGE: "arm32v7/debian:$FDO_DISTRIBUTION_VERSION"
+  needs:
+    - job: base-container-pre
   timeout: 30m
   stage: "Base container"
 
 aarch64-debian-lts-container_prep:
   extends:
-    - .ci-rules
+    - .default-rules
     - .debian-lts-aarch64
     - .fdo.container-build@debian
   tags:
     - aarch64
+  needs:
+    - job: base-container-pre
   timeout: 30m
   stage: "Base container"
 
 aarch64-debian-container_prep:
   extends:
-    - .ci-rules
+    - .default-rules
     - .debian-aarch64
     - .fdo.container-build@debian
   tags:
     - aarch64
+  needs:
+    - job: base-container-pre
   timeout: 30m
   stage: "Base container"
 
@@ -241,7 +269,7 @@ aarch64-debian-container_prep:
 # backend using the 'vkms' virtual driver under Linux.
 .build-and-test:
   extends:
-  - .ci-rules
+  - .default-rules
   script:
   - cd "$BUILDDIR"
   - meson --prefix="$PREFIX" --wrap-mode=nofallback -Db_sanitize=address ${MESON_OPTIONS} ${MESON_TOOLCHAIN_OPTIONS} ..
@@ -269,7 +297,7 @@ aarch64-debian-container_prep:
 # Same as above, but without running any tests.
 .build-no-test:
   extends:
-  - .ci-rules
+  - .default-rules
   script:
   - cd "$BUILDDIR"
   - meson --prefix="$PREFIX" --wrap-mode=nofallback ${MESON_OPTIONS} ..
@@ -528,7 +556,7 @@ aarch64-debian-no-gl-build:
 # invariant across any architecture or OS.
 docs-and-coverage:
   extends:
-    - .ci-rules
+    - .default-rules
     - .debian-x86_64
     - .fdo.suffixed-image@debian
   stage: pages
@@ -554,7 +582,7 @@ docs-and-coverage:
 # Generate the documentation for https://wayland.pages.freedesktop.org/weston/
 # Anything under public/ is published to this URL.
 #
-# Does not inherit .ci-rules as it should only run in our default branch for
+# Does not inherit .default-rules as it should only run in our default branch for
 # the upstream repo.
 pages:
   extends: