diff --git a/config/git.unkin.net/unkin/repository/app-sudaporn-research-individual.yaml b/config/git.unkin.net/unkin/repository/app-sudaporn-research-individual.yaml
index 73211ac..1fb51b3 100644
--- a/config/git.unkin.net/unkin/repository/app-sudaporn-research-individual.yaml
+++ b/config/git.unkin.net/unkin/repository/app-sudaporn-research-individual.yaml
@@ -2,3 +2,8 @@ description: "Sudaporn's Research Data visualisation, normalised "
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"
diff --git a/config/git.unkin.net/unkin/repository/app-sudaporn-research-normalised.yaml b/config/git.unkin.net/unkin/repository/app-sudaporn-research-normalised.yaml
index f01e9b3..06756d6 100644
--- a/config/git.unkin.net/unkin/repository/app-sudaporn-research-normalised.yaml
+++ b/config/git.unkin.net/unkin/repository/app-sudaporn-research-normalised.yaml
@@ -2,3 +2,8 @@ description: "Sudaporn's Research Data visualisation, normalised"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"
diff --git a/config/git.unkin.net/unkin/repository/benvin-utils.yaml b/config/git.unkin.net/unkin/repository/benvin-utils.yaml
index 07bca1a..0e675b0 100644
--- a/config/git.unkin.net/unkin/repository/benvin-utils.yaml
+++ b/config/git.unkin.net/unkin/repository/benvin-utils.yaml
@@ -2,3 +2,8 @@ description: "Monorepo of small single-purpose CLI tools sharing a common librar
 private: false
 default_branch: "main"
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"
diff --git a/config/git.unkin.net/unkin/repository/container-devcompute.yaml b/config/git.unkin.net/unkin/repository/container-devcompute.yaml
index ef95f8e..ae1f26b 100644
--- a/config/git.unkin.net/unkin/repository/container-devcompute.yaml
+++ b/config/git.unkin.net/unkin/repository/container-devcompute.yaml
@@ -1,3 +1,8 @@
 description: "Docker image to be used in Kubernetes as a developers container"
 private: false
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"
diff --git a/config/git.unkin.net/unkin/repository/docker-template.yaml b/config/git.unkin.net/unkin/repository/docker-template.yaml
index 42999f1..5b32a94 100644
--- a/config/git.unkin.net/unkin/repository/docker-template.yaml
+++ b/config/git.unkin.net/unkin/repository/docker-template.yaml
@@ -3,3 +3,8 @@ private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
 repo_template: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"
diff --git a/config/git.unkin.net/unkin/repository/initbuilder.yaml b/config/git.unkin.net/unkin/repository/initbuilder.yaml
index 85bcc49..9a01f4f 100644
--- a/config/git.unkin.net/unkin/repository/initbuilder.yaml
+++ b/config/git.unkin.net/unkin/repository/initbuilder.yaml
@@ -1,3 +1,8 @@
 description: "A repository for building initrd.img in docker "
 private: false
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"
diff --git a/config/git.unkin.net/unkin/repository/puppetapi.yaml b/config/git.unkin.net/unkin/repository/puppetapi.yaml
index be50ccc..bf2a61d 100644
--- a/config/git.unkin.net/unkin/repository/puppetapi.yaml
+++ b/config/git.unkin.net/unkin/repository/puppetapi.yaml
@@ -2,3 +2,8 @@ description: "A fastapi service to present puppet services via an api"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"
diff --git a/config/git.unkin.net/unkin/repository/rpmbuild-internal-ca-certificates.yaml b/config/git.unkin.net/unkin/repository/rpmbuild-internal-ca-certificates.yaml
index f2526d8..9ea46e5 100644
--- a/config/git.unkin.net/unkin/repository/rpmbuild-internal-ca-certificates.yaml
+++ b/config/git.unkin.net/unkin/repository/rpmbuild-internal-ca-certificates.yaml
@@ -2,3 +2,8 @@ description: "Package the internal ca-certificates"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"
diff --git a/config/git.unkin.net/unkin/repository/streamstack.yaml b/config/git.unkin.net/unkin/repository/streamstack.yaml
index fa9a000..02cb235 100644
--- a/config/git.unkin.net/unkin/repository/streamstack.yaml
+++ b/config/git.unkin.net/unkin/repository/streamstack.yaml
@@ -1,3 +1,8 @@
 description: "A stack of microservices that aim to offer a distributed streaming service."
 private: false
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"