diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 5ef8d6faf961ef1bcbca52a06bc913c0b368c641..adc2879b3605f2d6f7a3175938b360b5dbf55c09 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -101,6 +101,17 @@ push-merge-request-helm-nexus:
     paths:
       - "*.tgz"
 
+push-keystore-assembler-image-nexus:
+  stage: publish
+  script:
+    - docker build -f keystore-truststore-from-tls-secret.dockerfile -t keystore-truststore-from-tls-secret:latest .
+    - echo "$NEXUS_PASSWORD" | docker login -u "$NEXUS_USER" --password-stdin docker.ozg-sh.de
+    - docker tag keystore-truststore-from-tls-secret:latest docker.ozg-sh.de/keystore-truststore-from-tls-secret:latest
+    - docker push docker.ozg-sh.de/keystore-truststore-from-tls-secret:latest
+  when: manual
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+
 # Snapshot jobs
 push-snapshot-image-gitlab:
   stage: publish
@@ -143,14 +154,3 @@ push-release-image-nexus:
     - mvn deploy -Pnexus-deploy $MAVEN_DEPLOY_CLI_OPTS $MAVEN_CLI_OPTS
   rules:
     - if: $CI_COMMIT_TAG
-
-
-# Extra jobs
-push-keystore-assembler-image-nexus:
-  stage: publish
-  script:
-    - docker build -f keystore-truststore-from-tls-secret.dockerfile -t keystore-truststore-from-tls-secret:latest .
-    - echo "$NEXUS_PASSWORD" | docker login -u "$NEXUS_USER" --password-stdin nexus.ozg-sh.de
-    - docker tag keystore-truststore-from-tls-secret:latest docker.ozg-sh.de/keystore-truststore-from-tls-secret:latest
-    - docker push docker.ozg-sh.de/keystore-truststore-from-tls-secret:latest
-  when: manual
\ No newline at end of file