diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 1358687..8f53baf 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -110,6 +110,43 @@ docker_push:
     - docker push $IMAGE:$CI_COMMIT_REF_SLUG
     - if [ $CI_COMMIT_BRANCH == "master" ]; then docker push $IMAGE:latest; fi
 
+# Build and push the Satellite API docker image on deployments
+tag_docker_push:
+  stage: build
+  tags:
+    - k8s-docker
+  services:
+    - docker:19-dind
+  only:
+    - /^staging_.*/
+    - /^prod_.*/
+    - /^testnet_prod_.*/
+  except:
+    - branches@satellite/ionosphere
+  parallel:
+    matrix:
+      - IMAGE: $API_IMAGE
+        DIR: server
+      - IMAGE: $SSE_IMAGE
+        DIR: sse
+  script:
+    - cd $DIR
+    - docker pull $IMAGE:$CI_COMMIT_REF_SLUG || docker pull $IMAGE:latest || true
+    - >
+      docker build
+      -f Dockerfile
+      --network=host
+      --cache-from $IMAGE:$CI_COMMIT_REF_SLUG
+      --cache-from $IMAGE:latest
+      --build-arg BUILDKIT_INLINE_CACHE=1
+      -t $IMAGE:$CI_COMMIT_SHA
+      -t $IMAGE:$CI_COMMIT_REF_SLUG
+      -t $IMAGE:latest
+      .
+    - docker push $IMAGE:$CI_COMMIT_SHA
+    - docker push $IMAGE:$CI_COMMIT_REF_SLUG
+    - if [ $CI_COMMIT_BRANCH == "master" ]; then docker push $IMAGE:latest; fi
+
 # Any newly-pushed, WIP branch will be ran through plan (keep in mind docker images are using the latest tag, which may be an older one since the current commit may not match an available image)
 plan_staging:
   stage: plan
diff --git a/terraform/iam.tf b/terraform/iam.tf
index 02f4de0..f401ee8 100644
--- a/terraform/iam.tf
+++ b/terraform/iam.tf
@@ -3,12 +3,12 @@ resource "google_service_account" "api_server_ci" {
   account_id   = "satellite-api-tf-ci"
   display_name = "satellite-api-tf-ci"
   description  = "Terraform/CI"
-  count        = local.create_mainnet
+  count        = local.env == "prod" ? local.create_mainnet : 0
 }
 
 resource "google_project_iam_member" "api_server_ci" {
   project = var.project
   role    = "roles/editor"
   member  = "serviceAccount:${google_service_account.api_server_ci[0].email}"
-  count   = local.create_mainnet
+  count   = local.env == "prod" ? local.create_mainnet : 0
 }
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 21b13db..ff2b2b3 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -12,12 +12,6 @@ locals {
       create_testnet = 0
       create_misc    = 0
     }
-    "testnet-staging" = {
-      env            = "staging"
-      create_mainnet = 0
-      create_testnet = 1
-      create_misc    = 0
-    }
     "testnet-prod" = {
       env            = "prod"
       create_mainnet = 0