diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index a7922d60592011f28492f19df6962a5418dc04d5..51fc94a0821c5cb0bbb9ccc470a9961cb6271a0a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -50,7 +50,7 @@ cache-newest:prep:
         - .cargo_fetch_job
         - .cargo_build_tags
         - .cargo_fetch_artifacts
-        - .run_automatically
+        - .rules
 
 cache-mindeps:prep:
     extends:
@@ -58,7 +58,7 @@ cache-mindeps:prep:
         - .cargo_fetch_job
         - .cargo_build_tags
         - .cargo_fetch_artifacts
-        - .run_automatically
+        - .rules
     variables:
         GENERATE_LOCKFILE_ARGS: "-Z minimal-versions"
         CARGO_UPDATE_POLICY: mindeps
@@ -70,7 +70,7 @@ clippy:build:
         - .cargo_no_features
         - .cargo_clippy_job
         - .cargo_build_tags
-        - .run_automatically
+        - .rules
     needs:
         - cache-newest:prep
 
@@ -80,7 +80,7 @@ clippy-features:build:
         - .cargo_all_features
         - .cargo_clippy_job
         - .cargo_build_tags
-        - .run_automatically
+        - .rules
     needs:
         - cache-newest:prep
 
@@ -96,7 +96,7 @@ semver-checks:prep:
         - .rust_stable
         - .cargo_semver_checks_job
         - .cargo_build_tags
-        - .run_automatically
+        - .rules
     variables:
         CARGO_FEATURES: "--only-explicit-features --features _nohooks"
         CHANGELOG_PATH: CHANGELOG.md
@@ -106,7 +106,7 @@ semver-checks:features:prep:
         - .rust_stable
         - .cargo_semver_checks_job
         - .cargo_build_tags
-        - .run_automatically
+        - .rules
     variables:
         CARGO_FEATURES: "--only-explicit-features --features _nohooks --features client_api"
         CHANGELOG_PATH: CHANGELOG.md
@@ -116,7 +116,7 @@ audit-mindeps:build:
         - .rust_minimum_mindeps
         - .cargo_audit_job
         - .cargo_build_tags
-        - .run_automatically
+        - .rules
         - .cargo_audit_ignore
     stage: advice
     needs:
@@ -130,7 +130,7 @@ audit-newest:build:
         - .rust_stable
         - .cargo_audit_job
         - .cargo_build_tags
-        - .run_automatically
+        - .rules
         - .cargo_audit_ignore
     needs:
         - cache-newest:prep
@@ -142,7 +142,7 @@ stable:build:
         - .cargo_build_job
         - .cargo_build_tags
         - .cargo_build_artifacts
-        - .run_automatically
+        - .rules
     needs:
         - cache-newest:prep
 
@@ -153,7 +153,7 @@ stable:test:
         - .cargo_test_job
         - .cargo_build_tags
         - .cargo_test_artifacts
-        - .run_automatically
+        - .rules
     needs:
         - stable:build
 
@@ -164,7 +164,7 @@ nightly:build:
         - .cargo_build_job
         - .cargo_build_tags
         - .cargo_build_artifacts
-        - .run_automatically
+        - .rules
     needs:
         - cache-newest:prep
 
@@ -175,7 +175,7 @@ nightly:test:
         - .cargo_test_job
         - .cargo_build_tags
         - .cargo_test_artifacts
-        - .run_automatically
+        - .rules
     needs:
         - nightly:build
 
@@ -186,7 +186,7 @@ mindeps:build:
         - .cargo_build_job
         - .cargo_build_tags
         - .cargo_build_artifacts
-        - .run_automatically
+        - .rules
     needs:
       - cache-mindeps:prep
 
@@ -197,7 +197,7 @@ mindeps:test:
         - .cargo_test_job
         - .cargo_build_tags
         - .cargo_test_artifacts
-        - .run_automatically
+        - .rules
     needs:
         - mindeps:build
 
@@ -208,7 +208,7 @@ stable-features:build:
         - .cargo_build_job
         - .cargo_build_tags
         - .cargo_build_artifacts
-        - .run_automatically
+        - .rules
     needs:
         - cache-newest:prep
 
@@ -219,7 +219,7 @@ stable-features:test:
         - .cargo_test_job
         - .cargo_build_tags
         - .cargo_test_artifacts
-        - .run_automatically
+        - .rules
     needs:
         - stable-features:build
 
@@ -230,7 +230,7 @@ tarpaulin-features:build:
         - .cargo_tarpaulin_build_job
         - .cargo_build_tags
         - .cargo_build_artifacts
-        - .run_automatically
+        - .rules
     needs:
         - cache-newest:prep
 
@@ -240,7 +240,7 @@ tarpaulin-features:test:
         - .cargo_all_features
         - .cargo_tarpaulin_test_job
         - .cargo_privileged_tags
-        - .run_automatically
+        - .rules
     needs:
         - tarpaulin-features:build
 
@@ -251,7 +251,7 @@ nightly-features:build:
         - .cargo_build_job
         - .cargo_build_tags
         - .cargo_build_artifacts
-        - .run_automatically
+        - .rules
     needs:
         - cache-newest:prep
 
@@ -262,7 +262,7 @@ nightly-features:test:
         - .cargo_test_job
         - .cargo_build_tags
         - .cargo_test_artifacts
-        - .run_automatically
+        - .rules
     needs:
         - nightly-features:build
 
@@ -273,7 +273,7 @@ mindeps-features:build:
         - .cargo_build_job
         - .cargo_build_tags
         - .cargo_build_artifacts
-        - .run_automatically
+        - .rules
     needs:
         - cache-mindeps:prep
 
@@ -284,7 +284,7 @@ mindeps-features:test:
         - .cargo_test_job
         - .cargo_build_tags
         - .cargo_test_artifacts
-        - .run_automatically
+        - .rules
     needs:
         - mindeps-features:build
 
@@ -293,7 +293,7 @@ publish:
         - .rust_stable
         - .cargo_publish_job
         - .cargo_build_tags
-        - .run_automatically
+        - .rules
     needs:
         # - job: audit-mindeps:build
         #   artifacts: false
diff --git a/.gitlab/cargo.yml b/.gitlab/cargo.yml
index bf23b5a1e191e4538ad321f6cfc7de55ff320649..62df791c9f32be3c632b2cd891802517bc80a4f1 100644
--- a/.gitlab/cargo.yml
+++ b/.gitlab/cargo.yml
@@ -129,4 +129,4 @@
         - cargo --version
         - cargo publish --no-verify --token $CRATES_IO_TOKEN
     variables:
-        IS_FOR_RELEASE: "true"
+        RUST_CI_RELEASE_ONLY: "true"
diff --git a/.gitlab/rules.yml b/.gitlab/rules.yml
index 9705f8c0d1ff1575607d7fd38a5799c21c1df846..b2e9ffd52b3df3f3087f4aaf63f2f77a05029ba5 100644
--- a/.gitlab/rules.yml
+++ b/.gitlab/rules.yml
@@ -1,22 +1,48 @@
 # Rules for where jobs can run
 
-.run_automatically:
+###
+# Job variables:
+#   RUST_CI_RELEASE_ONLY
+#     Set to "true" to only perform for tag pipelines.
+###
+
+# When to even consider running a pipeline.
+workflow:
     rules:
-        # Release jobs ignore MRs.
-        - if: '$CI_MERGE_REQUEST_ID && $IS_FOR_RELEASE == "true"'
-          when: never
+        # Run for merge requests.
         - if: '$CI_MERGE_REQUEST_ID'
-          when: on_success
-        # Non-protected branches without tags should be skipped.
-        - if: '$CI_COMMIT_REF_PROTECTED != "true" && $CI_COMMIT_TAG == ""'
+          when: always
+          auto_cancel:
+              # Cancel all pipeline jobs if a new commit comes in on the branch.
+              on_new_commit: interruptible
+        # Do not run for other projects.
+        - if: '$CI_PROJECT_PATH != "utils/rust-gitlab"'
           when: never
-        # Run everything for tags.
-        - if: '$CI_PROJECT_PATH == "utils/rust-gitlab" && $CI_COMMIT_TAG'
+        # Run for protected branches.
+        - if: '$CI_COMMIT_REF_PROTECTED == "true"'
+          when: always
+          auto_cancel:
+              # Cancel all pipeline jobs if a new commit comes in on the branch.
+              on_new_commit: interruptible
+        # Run for tags.
+        - if: '$CI_COMMIT_TAG'
+          when: always
+        # Run for schedules.
+        - if: '$CI_PIPELINE_SOURCE == "schedule"'
+          when: always
+          auto_cancel:
+              # Never cancel scheduled pipelines because of new commits.
+              on_new_commit: none
+        # Skip pipelines in all other cases.
+        - when: never
+
+.rules:
+    rules:
+        # Run release-only jobs for tags.
+        - if: '$RUST_CI_RELEASE_ONLY == "true" && $CI_COMMIT_TAG'
           when: on_success
-        # Skip release-only jobs.
-        - if: '$CI_PROJECT_PATH == "utils/rust-gitlab" && $IS_FOR_RELEASE == "true"'
+        # Skip release jobs without tag.
+        - if: '$RUST_CI_RELEASE_ONLY == "true"'
           when: never
-        # Run everything on the main project.
-        - if: '$CI_PROJECT_PATH == "utils/rust-gitlab"'
-          when: on_success
-        - when: never
+        # Other jobs run right away.
+        - when: on_success