diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 1b9b445f445ac5ee13a768034ab1d1e9ac70b7a0..5b598bf0c59c60b566987d3290ee7798ed97f0c3 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -163,11 +163,13 @@ doc:
 deckard:linux:amd64:
   stage: test
   except:
-    - master@knot/knot-resolver
+    refs:
+      - master@knot/knot-resolver
+    variables:
+      # prevent unstable test from cancelling nightly OBS build
+      - $SKIP_DECKARD == "1"
   variables:
     TMPDIR: $CI_PROJECT_DIR
-  except:
-    - schedules  # prevent unstable test from cancelling nightly OBS build
   script:
     - DECKARDFLAGS="-n $(nproc)" PATH="$PREFIX/sbin:$PATH" make check-integration
   # these errors are side-effect of Git way of handling file timestamps
@@ -510,9 +512,11 @@ nightly:copy:
   dependencies: []
   script:
     # delete nightly branch
+    - 'curl --request PUT --header "PRIVATE-TOKEN: $GITLAB_API_TOKEN" "https://gitlab.labs.nic.cz/api/v4/projects/147/repository/branches/nightly/unprotect"'
     - 'curl --request DELETE --header "PRIVATE-TOKEN: $GITLAB_API_TOKEN" "https://gitlab.labs.nic.cz/api/v4/projects/147/repository/branches/nightly"'
     # recreate nightly branch from current master
     - 'curl --request POST --header "PRIVATE-TOKEN: $GITLAB_API_TOKEN" "https://gitlab.labs.nic.cz/api/v4/projects/147/repository/branches?branch=nightly&ref=master"'
+    - 'curl --request PUT --header "PRIVATE-TOKEN: $GITLAB_API_TOKEN" "https://gitlab.labs.nic.cz/api/v4/projects/147/repository/branches/nightly/protect"'
 
 
 #arm_build: