diff --git a/app/services/ci/create_pipeline_service.rb b/app/services/ci/create_pipeline_service.rb
index 485161e5f3ffb342f4a2508412f4d18ac787f627..a8034e30a85fb3dbc5f741ed616aff510cdb54b3 100644
--- a/app/services/ci/create_pipeline_service.rb
+++ b/app/services/ci/create_pipeline_service.rb
@@ -28,7 +28,7 @@ module Ci
       end
 
       unless triggering_user_allowed_for_ref?(trigger_request)
-        return error("Insufficient permissions for protected #{ref}")
+        return error("Insufficient permissions for protected ref '#{ref}'")
       end
 
       unless commit
@@ -77,8 +77,11 @@ module Ci
     def triggering_user_allowed_for_ref?(trigger_request)
       triggering_user = current_user || trigger_request.trigger.owner
 
-      (triggering_user && allowed_to_create?(triggering_user)) ||
+      if triggering_user
+        allowed_to_create?(triggering_user)
+      else # legacy triggers don't have a corresponding user
         !project.protected_for?(ref)
+      end
     end
 
     def allowed_to_create?(triggering_user)