diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index ba318ff9a5e102ac128d0c51a04e7e714f958350..7e1a080e377f84b18f024ef3a7f0da37a7d02d95 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -132,6 +132,7 @@ build_lofar_pulp_docker_image:
   needs:
     - build_pulp_docker_image
   interruptible: true
+  when: manual
 
 
 #
@@ -398,6 +399,15 @@ deploy-MCU_MAC-test:
 
 deploy-PULP:
   stage: deploy
+  before_script:
+    # needed so that gitlab-runner can login at cep4
+    - 'which ssh-agent || ( apt-get update -y && apt-get install openssh-client git -y )'
+    - eval $(ssh-agent -s)
+    - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -
+    - mkdir -p ~/.ssh
+    - chmod 700 ~/.ssh
+    - ssh-keyscan head.cep4.control.lofar >> ~/.ssh/known_hosts
+    - chmod 644 ~/.ssh/known_hosts
   script:
     # notice we do NOT use 'lofar-pulp' as name here (yet)
     # TODO: when the new pulp-image-via-gitlab-via-nexus-to-cep4 is done and working, then and only then rename it here to the widely used docker image name 'lofar-pulp'