diff --git a/config/git.unkin.net/user/repospawner.yaml b/config/git.unkin.net/user/repospawner.yaml
index 8bea574..9cc0c39 100644
--- a/config/git.unkin.net/user/repospawner.yaml
+++ b/config/git.unkin.net/user/repospawner.yaml
@@ -15,5 +15,8 @@ description: "repospawner service identity -- opens repo-creation PRs against te
 # profile visible only to signed-in users.
 visibility: limited
 admin: false
+# Restricted: account can only see repos/orgs it is explicitly added to -- the
+# repospawner team grant on terraform-git is all it needs.
+restricted: true
 allow_create_organization: false
 max_repo_creation: 0