diff --git a/app/models/merge_request.rb b/app/models/merge_request.rb
index 616efaf3c421087dfc5a744e008d791be43923e7..1cdd0585b6887e9a9f81eb62f91e2d0d5937357d 100644
--- a/app/models/merge_request.rb
+++ b/app/models/merge_request.rb
@@ -670,9 +670,12 @@ class MergeRequest < ActiveRecord::Base
   def environments
     return [] unless diff_head_commit
 
-    target_project.environments.select do |environment|
-      environment.includes_commit?(diff_head_commit)
-    end
+    environments = source_project.environments_for(
+      source_branch, diff_head_commit)
+    environments <<= target_project.environments_for(
+      source_branch, diff_head_commit, with_tags: true)
+
+    environments
   end
 
   def state_human_name
diff --git a/app/models/project.rb b/app/models/project.rb
index d7f20070be0bc8737982cc481d0be1dcd7dee5f7..22402305f59612ffb69693eaabe58e5f9097c66b 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -1293,6 +1293,22 @@ class Project < ActiveRecord::Base
     Gitlab::Redis.with { |redis| redis.del(pushes_since_gc_redis_key) }
   end
 
+  def environments_for(ref, commit, with_tags: false)
+    environment_ids = deployments.group(:environment_id).
+      select(:environment_id)
+
+    environment_ids =
+      if with_tags
+        environment_ids.where('ref=? OR tag IS TRUE', ref)
+      else
+        environment_ids.where(ref: ref)
+      end
+
+    Environment.where(id: environment_ids).map do |environment|
+      environment.includes_commit?(commit)
+    end
+  end
+
   private
 
   def pushes_since_gc_redis_key
diff --git a/app/views/projects/merge_requests/widget/_heading.html.haml b/app/views/projects/merge_requests/widget/_heading.html.haml
index 494695a03a50e3363efe1f8bf06b2ef01aab6493..d8b19d8c95121ef3e0703932b244ff087ccf1f1f 100644
--- a/app/views/projects/merge_requests/widget/_heading.html.haml
+++ b/app/views/projects/merge_requests/widget/_heading.html.haml
@@ -44,14 +44,15 @@
       Could not connect to the CI server. Please check your settings and try again.
 
 - @merge_request.environments.each do |environment|
-  .mr-widget-heading
-    .ci_widget.ci-success
-      = ci_icon_for_status("success")
-      %span.hidden-sm
-        Deployed to
-        = succeed '.' do
-          = link_to environment.name, namespace_project_environment_path(@project.namespace, @project, environment), class: 'environment'
-        - external_url = environment.external_url
-        - if external_url
-          = link_to external_url, target: '_blank' do
-            = icon('external-link', text: "View on #{external_url.gsub(/\A.*?:\/\//, '')}", right: true)
+  - if can?(current_user, :read_environment, environment)
+    .mr-widget-heading
+      .ci_widget.ci-success
+        = ci_icon_for_status("success")
+        %span.hidden-sm
+          Deployed to
+          = succeed '.' do
+            = link_to environment.name, namespace_project_environment_path(@project.namespace, @project, environment), class: 'environment'
+          - external_url = environment.external_url
+          - if external_url
+            = link_to external_url, target: '_blank' do
+              = icon('external-link', text: "View on #{external_url.gsub(/\A.*?:\/\//, '')}", right: true)