diff --git a/services/gerrit/one-way-sync.nix b/services/gerrit/one-way-sync.nix
index cdb86c0..fcf5460 100644
--- a/services/gerrit/one-way-sync.nix
+++ b/services/gerrit/one-way-sync.nix
@@ -15,7 +15,7 @@ let
   mkSyncService = targetRef: { name, fromUri, fromRefspec, localRefspec, ... }: {
     path = [ pkgs.gitFull pkgs.openssh ];
     script = ''
-      set -x
+      set -xe
       trap "git worktree prune && git worktree remove -f ${name}" EXIT
 
       if [ ! -d "/var/lib/onewaysync/nixpkgs" ]; then
@@ -33,7 +33,15 @@ let
       git config user.name Fork-o-Tron
       git config user.email noreply@forkos.org
       git fetch ${fromUri} ${fromRefspec}
+    '' + lib.optionalString (!(lib.hasInfix "staging" localRefspec)) ''
+      OLD_STDENV=$(nix eval -f . stdenv.outPath)
+    '' + ''
       git merge FETCH_HEAD
+    '' + lib.optionalString (!(lib.hasInfix "staging" localRefspec)) ''
+      NEW_STDENV=$(nix eval -f . stdenv.outPath)
+      # Do not allow auto-merging a staging iteration
+      test "$OLD_STDENV" = "$NEW_STDENV"
+    '' + ''
       GIT_SSH_COMMAND='ssh -i ${cfg.deployKeyPath}' git push ${cfg.pushUrl} HEAD:${targetRef}
     '';
     serviceConfig = {