diff --git a/atst/domain/application_roles.py b/atst/domain/application_roles.py
index 1919b30f..819f0758 100644
--- a/atst/domain/application_roles.py
+++ b/atst/domain/application_roles.py
@@ -3,6 +3,7 @@ from typing import List
 from uuid import UUID
 
 from sqlalchemy.orm.exc import NoResultFound
+from sqlalchemy import func, and_, or_
 
 from atst.database import db
 from atst.domain.environment_roles import EnvironmentRoles
@@ -116,11 +117,19 @@ class ApplicationRoles(object):
             db.session.query(ApplicationRole.id, ApplicationRole.user_id, Portfolio.id)
             .join(Application, Application.id == ApplicationRole.application_id)
             .join(Portfolio, Portfolio.id == Application.portfolio_id)
-            .filter(Application.cloud_id.isnot(None))
-            .filter(ApplicationRole.deleted == False)
-            .filter(ApplicationRole.cloud_id.is_(None))
-            .filter(ApplicationRole.user_id.isnot(None))
-            .filter(ApplicationRole.status == ApplicationRoleStatus.ACTIVE)
+            .filter(
+                and_(
+                    Application.cloud_id.isnot(None),
+                    ApplicationRole.deleted == False,
+                    ApplicationRole.cloud_id.is_(None),
+                    ApplicationRole.user_id.isnot(None),
+                    ApplicationRole.status == ApplicationRoleStatus.ACTIVE,
+                    or_(
+                        ApplicationRole.claimed_until.is_(None),
+                        ApplicationRole.claimed_until <= func.now(),
+                    ),
+                )
+            )
         ).all()
 
         groups = []
diff --git a/atst/domain/applications.py b/atst/domain/applications.py
index b9df260e..8b873b02 100644
--- a/atst/domain/applications.py
+++ b/atst/domain/applications.py
@@ -1,5 +1,5 @@
 from flask import g
-from sqlalchemy import func, or_
+from sqlalchemy import func, or_, and_
 from typing import List
 from uuid import UUID
 
@@ -132,13 +132,15 @@ class Applications(BaseDomainClass):
             db.session.query(Application.id)
             .join(Portfolio)
             .join(PortfolioStateMachine)
-            .filter(PortfolioStateMachine.state == FSMStates.COMPLETED)
-            .filter(Application.deleted == False)
-            .filter(Application.cloud_id.is_(None))
             .filter(
-                or_(
-                    Application.claimed_until.is_(None),
-                    Application.claimed_until <= func.now(),
+                and_(
+                    PortfolioStateMachine.state == FSMStates.COMPLETED,
+                    Application.deleted == False,
+                    Application.cloud_id.is_(None),
+                    or_(
+                        Application.claimed_until.is_(None),
+                        Application.claimed_until <= func.now(),
+                    ),
                 )
             )
         ).all()
diff --git a/atst/domain/environment_roles.py b/atst/domain/environment_roles.py
index c0bd8e7b..d89b4d78 100644
--- a/atst/domain/environment_roles.py
+++ b/atst/domain/environment_roles.py
@@ -1,4 +1,5 @@
 from sqlalchemy.orm.exc import NoResultFound
+from sqlalchemy import func, and_, or_
 from flask import current_app as app
 
 from atst.database import db
@@ -95,13 +96,21 @@ class EnvironmentRoles(object):
             db.session.query(EnvironmentRole.id)
             .join(Environment)
             .join(ApplicationRole)
-            .filter(Environment.deleted == False)
-            .filter(EnvironmentRole.deleted == False)
-            .filter(ApplicationRole.deleted == False)
-            .filter(ApplicationRole.cloud_id != None)
-            .filter(ApplicationRole.status != ApplicationRoleStatus.DISABLED)
-            .filter(EnvironmentRole.status != EnvironmentRole.Status.DISABLED)
-            .filter(EnvironmentRole.cloud_id.is_(None))
+            .filter(
+                and_(
+                    Environment.deleted == False,
+                    EnvironmentRole.deleted == False,
+                    ApplicationRole.deleted == False,
+                    ApplicationRole.cloud_id != None,
+                    ApplicationRole.status != ApplicationRoleStatus.DISABLED,
+                    EnvironmentRole.status != EnvironmentRole.Status.DISABLED,
+                    EnvironmentRole.cloud_id.is_(None),
+                    or_(
+                        EnvironmentRole.claimed_until.is_(None),
+                        EnvironmentRole.claimed_until <= func.now(),
+                    ),
+                )
+            )
             .all()
         )
         return [id_ for id_, in results]
diff --git a/atst/domain/environments.py b/atst/domain/environments.py
index b43ae495..42e5815c 100644
--- a/atst/domain/environments.py
+++ b/atst/domain/environments.py
@@ -1,4 +1,4 @@
-from sqlalchemy import func, or_
+from sqlalchemy import func, or_, and_
 from sqlalchemy.orm.exc import NoResultFound
 from typing import List
 from uuid import UUID
@@ -125,8 +125,16 @@ class Environments(object):
         """
         results = (
             cls.base_provision_query(now)
-            .filter(Application.cloud_id != None)
-            .filter(Environment.cloud_id.is_(None))
+            .filter(
+                and_(
+                    Application.cloud_id != None,
+                    Environment.cloud_id.is_(None),
+                    or_(
+                        Environment.claimed_until.is_(None),
+                        Environment.claimed_until <= func.now(),
+                    ),
+                )
+            )
             .all()
         )
         return [id_ for id_, in results]