diff --git a/config/git.unkin.net/unkin/repository/jellyfin-plugin-sso.yaml b/config/git.unkin.net/unkin/repository/jellyfin-plugin-sso.yaml
index b1c5254..30c42b2 100644
--- a/config/git.unkin.net/unkin/repository/jellyfin-plugin-sso.yaml
+++ b/config/git.unkin.net/unkin/repository/jellyfin-plugin-sso.yaml
@@ -1 +1,15 @@
 fork_from: "mirrors/jellyfin-plugin-sso"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    # Whitelist-push: the owner pushes main directly when syncing upstream;
+    # everyone else must open a PR.
+    enable_push: true
+    push_whitelist_users:
+      - "unkinben"
+    # PRs to main must pass the plugin build pipeline before merge.
+    status_check_contexts:
+      - "ci/woodpecker/pr/ci"
+    approval_whitelist_teams:
+      - "Owners"