GitLab Premium vs Ultimate: which tier does your team actually need?

Choose GitLab Premium if your main goal is faster, better-governed delivery: required approvals, Code Owners, merge trains, epics and 10,000 compute minutes a month. Choose GitLab Ultimate if you also need built-in application security (dependency scanning, DAST, vulnerability management, security policies) and compliance enforcement, or if you have many stakeholders who only need Guest access. Premium is listed at US$29 per user per month, billed annually. Ultimate is now custom pricing, so it has to be quoted.

This guide sets out the differences that usually decide the question, with the source for each claim. Prices and features were checked on 13 October 2026.

The short version

Prices and allowances from GitLab’s pricing page (checked 13 October 2026). Feature tiers from the GitLab documentation linked in the sources.

A note on the old number: several third-party sites still quote Ultimate at US$99 per user per month. GitLab no longer publishes an Ultimate list price, so treat that figure as out of date.

What Premium gives you

Premium is the tier most teams outgrow Free into. The features that matter in practice:

• Required approval rules. On Free, approvals are optional and do not block a merge. Premium lets you require a minimum number of approvals from named reviewers or groups before code can merge.
• Code Owners. Map paths in the repository to the people or teams who must review changes to them.
• Merge trains. Queue merge requests so each one is tested against the combined result of those ahead of it, which keeps the default branch green on busy repositories.
• Epics and planning. Single-level epics are in Premium. Nested (child) epics are Ultimate only.
• Compliance frameworks (basic). You can label projects with frameworks in Premium, which helps with reporting.
• 10,000 compute minutes a month on GitLab.com, compared with 400 on Free.

For a software team that already uses a separate security scanner, or that is not yet under formal audit pressure, Premium is often the right answer. It is the cheaper option and it covers most day-to-day delivery workflows. Our CI/CD services are built to get the most out of Premium before you consider an upgrade.

What Ultimate adds

Ultimate is aimed at organisations that want security and compliance inside the developer workflow rather than in a separate tool.

Application security testing

• Dependency scanning (software composition analysis) checks your open-source dependencies, including transitive ones, against known vulnerabilities. It is Ultimate only.
• DAST tests running applications and APIs. It is Ultimate only.
• Container scanning runs on every tier, but Ultimate adds results in the merge request and pipeline security tab, the vulnerability report, the full GitLab advisory database and scanning of images in the container registry. Free and Premium receive time-delayed community advisory data.
• Secret push protection blocks keys and tokens from being pushed in the first place. It is Ultimate only.

Vulnerability management and policy

• Security dashboard and vulnerability report give security teams one place to triage findings across projects.
• Security policies let you require scans to run (scan execution policies) and require security approval when a merge request introduces risk (merge request approval policies). This is the feature that turns scanning from advice into a control.

Compliance enforcement

Compliance frameworks exist in Premium, but in Ultimate a framework can enforce pipeline configuration and security policies on every project it is applied to. Ultimate also adds framework templates and defined requirements with GitLab and external controls. If you are preparing for an audit against a standard your regulator or customers expect, this is usually where Ultimate earns its price.

Guest users and portfolio management

On Ultimate, users with the Guest role do not count as billable seats. If you have product owners, auditors or business stakeholders who only need to view and comment on issues, that can change the commercial maths significantly. Ultimate also adds portfolio and value stream management features.

AI: GitLab Duo and GitLab Credits

GitLab introduced GitLab Credits with the GitLab Duo Agent Platform in GitLab 18.8 (January 2026). Credits are listed at US$1 each on demand. At the time of checking, GitLab was running a promotion that includes US$12 of credits per user per month on Premium and US$24 on Ultimate. GitLab describes this as a limited-time offer that can change, and the pricing page marks it as GitLab.com only. If you run Self-Managed, confirm the position for your version before relying on included credits in a budget.

AI usage should not decide the tier on its own. Decide on security and compliance needs first, then size AI usage separately.

When Premium is the better choice

Be honest with yourself about these situations:

• You already own a mature application security stack and have no plan to replace it. Paying for Ultimate’s scanners on top would duplicate spend.
• You are a small team without a dedicated security function. Scan results that nobody triages add noise, not safety. Start with Premium, the free basic scanners and good branch protection.
• Your compliance needs are about evidence, not enforcement. Premium approvals, Code Owners and audit-friendly merge requests may be enough.
• Budget certainty matters more than features this year. Premium has a published list price. Ultimate needs a negotiation.

When Ultimate is the better choice

• You are consolidating tools. If Ultimate replaces a separate SAST, SCA or DAST product, compare the total, not just the seat price.
• You are regulated or audited. Financial services, healthcare and public-sector suppliers often need enforced policies and demonstrable controls.
• You have many view-only stakeholders. Free Guest seats can offset part of the price difference.
• Software supply chain security is a board topic. Our software supply chain security checklist shows where Ultimate’s controls fit.

See our GitLab Ultimate page for how we run an evaluation and a 30-day trial with your own repositories.

How to decide in a week

1. List your current security tools and their renewal dates. Ultimate is easier to justify when it replaces something.
2. Count users by role. Separate developers from people who only need Guest access.
3. Run a trial on real projects. GitLab offers a 30-day trial with nearly all Ultimate features. Turn on dependency scanning and a merge request approval policy and see whether your team acts on the results.
4. Model renewal costs. GitLab uses quarterly reconciliation by default for newer subscriptions, so users added mid-term are billed for the remaining quarters rather than a full year.
5. Get a quote for both tiers. Pricing through a partner can differ from list, and Ultimate is quote-only anyway.

For how pricing, VAT and currency work for South African buyers, read how GitLab licensing and pricing works in South Africa. If you are also weighing deployment options, see GitLab.com vs Self-Managed vs Dedicated.

Talk to us

Spreeze is an authorised GitLab partner (Open track) based in Midrand. We can quote Premium and Ultimate side by side, in USD or ZAR (your choice), and help you run a trial that answers the question with your own code. Request a quote.

GITLAB is a trademark of GitLab Inc. Other names are trademarks of their respective owners.