diff --git a/config/git.unkin.net/unkin/repository/openbao.yaml b/config/git.unkin.net/unkin/repository/openbao.yaml
index 8b1272c..767338b 100644
--- a/config/git.unkin.net/unkin/repository/openbao.yaml
+++ b/config/git.unkin.net/unkin/repository/openbao.yaml
@@ -2,3 +2,14 @@ description: "Private fork of OpenBao adding per-namespace raft, cross-cluster p
 private: true
 default_branch: "main"
 default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    # Whitelist-push: the owner can push main directly (needed for the initial
+    # push and the fork's maintenance workflow); everyone else must open a PR.
+    enable_push: true
+    push_whitelist_users:
+      - "unkinben"
+    # PRs to main must pass the fork build/vet pipeline before merge.
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"