diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b407d42bdcaf00db9eef3bab413f6c80e3f6ce77..560f044488c92a575ea81b7a84b37ae89bf771af 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -76,9 +76,15 @@ workflow:
       git clone "${CI_REPOSITORY_URL}" "$(basename "${APP_DEPLOY_DIR}")";
       fi
     - cd "${APP_DEPLOY_DIR}";
+    # fetch tags so checkout doesn't create  a branch
     - git fetch --tags;
+    # switch to requested tag/branch
     - git checkout "${CI_COMMIT_REF_NAME}" || git checkout -b "${CI_COMMIT_REF_NAME}";
-    - git pull --ff-only "${CI_REPOSITORY_URL}" "${CI_COMMIT_REF_NAME}";
+    # pull updates if on a branch
+    - |
+      if ! git status | grep -q detached ; then
+        git pull --ff-only "${CI_REPOSITORY_URL}" "${CI_COMMIT_REF_NAME}";
+      fi
   stage: deploy
   tags:
     - deploy