--- a/buildfarm/release/release-runner.py
+++ b/buildfarm/release/release-runner.py
@@ -79,24 +79,35 @@ def bump_version(version):
         v.append("0")
     v[-1] = str(int(v[-1]) + 1)
     return split_by.join(v)
 
 
 def matches(name, patterns):
     return any([re.search(p, name) for p in patterns])
 
+def is_candidate_release(channels):
+    """determine if this is a candidate release or not
+
+    Because ship-it can not tell us if this is a candidate release (yet!), we assume it is when we
+    have determined, based on version, that we are planning to ship to more than one update_channel
+    e.g. for candidate releases we have:
+     1) one channel to test the 'candidate' release with: to 'beta' channel users
+     2) once verified, we ship to the main channel: to 'release' channel users
+    """
+    return len(channels) > 1
 
 def update_channels(version, mappings):
     """Return a list of update channels for a version using version mapping
 
     >>> update_channels("40.0", [(r"^\d+\.0$", ["beta", "release"]), (r"^\d+\.\d+\.\d+$", ["release"])])
     ["beta", "release"]
     >>> update_channels("40.0.1", [(r"^\d+\.0$", ["beta", "release"]), (r"^\d+\.\d+\.\d+$", ["release"])])
     ["release"]
+
     """
     for pattern, channels in mappings:
         if re.match(pattern, version):
             return channels
     raise RuntimeError("Cannot find update channels for %s" % version)
 
 
 def get_display_version(repo_path, revision):
@@ -524,16 +535,38 @@ def main(options):
             else:
                 log.info("Adding %s -> %s symlink" % (symlink, target))
                 os.symlink(target, symlink)
 
     # TODO: this won't work for Thunderbird...do we care?
     branch = release["branch"].split("/")[-1]
     branchConfig = readBranchConfig(path.join(configs_workdir, "mozilla"), branch=branch)
 
+    release_channels = update_channels(release["version"], branchConfig["release_channel_mappings"])
+    # candidate releases are split in two graphs and release-runner only handles the first
+    # graph of tasks. so parts like postrelease, push_to_releases/mirrors, and mirror dependant
+    # channels are handled in the second generated graph outside of release-runner.
+    # This is not elegant but it should do the job for now
+    candidate_release = is_candidate_release(release_channels)
+    if candidate_release:
+        postrelease_enabled = False
+        final_verify_channels = [
+            c for c in release_channels if c not in branchConfig.get('mirror_requiring_channels', [])
+        ]
+        # TODO - use publish_to_balrog_channels once releasetasks publishes to balrog
+        publish_to_balrog_channels = [
+            c for c in release_channels if c not in branchConfig.get('mirror_requiring_channels', [])
+        ]
+        push_to_releases_enabled = False
+    else:
+        postrelease_enabled = branchConfig['postrelease_version_bump_enabled']
+        final_verify_channels = release_channels
+        publish_to_balrog_channels = release_channels
+        push_to_releases_enabled = True
+
     rc = 0
     for release in rr.new_releases:
         try:
             rr.update_status(release, 'Generating task graph')
             l10n_changesets = parsePlainL10nChangesets(rr.get_release_l10n(release["name"]))
 
             kwargs = {
                 "public_key": docker_worker_key,
@@ -558,22 +591,23 @@ def main(options):
                 "funsize_balrog_api_root": branchConfig["funsize_balrog_api_root"],
                 "balrog_username": balrog_username,
                 "balrog_password": balrog_password,
                 "beetmover_aws_access_key_id": beetmover_aws_access_key_id,
                 "beetmover_aws_secret_access_key": beetmover_aws_secret_access_key,
                 # TODO: stagin specific, make them configurable
                 "signing_class": "release-signing",
                 "bouncer_enabled": branchConfig["bouncer_enabled"],
-                "release_channels": update_channels(release["version"], branchConfig["release_channel_mappings"]),
+                "release_channels": release_channels,
+                "final_verify_channels": final_verify_channels,
                 "signing_pvt_key": signing_pvt_key,
                 "build_tools_repo_path": branchConfig['build_tools_repo_path'],
                 "push_to_candidates_enabled": branchConfig['push_to_candidates_enabled'],
-                "postrelease_version_bump_enabled": branchConfig['postrelease_version_bump_enabled'],
-                "push_to_releases_enabled": True,
+                "postrelease_version_bump_enabled": postrelease_enabled,
+                "push_to_releases_enabled": push_to_releases_enabled,
                 "push_to_releases_automatic": branchConfig['push_to_releases_automatic'],
                 "beetmover_candidates_bucket": branchConfig["beetmover_buckets"][release["product"]],
             }
             if extra_balrog_submitter_params:
                 kwargs["extra_balrog_submitter_params"] = extra_balrog_submitter_params
 
             validate_graph_kwargs(queue, gpg_key_path, **kwargs)