diff --git a/config/git.unkin.net/unkin/repository/waitfordb.yaml b/config/git.unkin.net/unkin/repository/waitfordb.yaml
index bed69fb..db0f03c 100644
--- a/config/git.unkin.net/unkin/repository/waitfordb.yaml
+++ b/config/git.unkin.net/unkin/repository/waitfordb.yaml
@@ -3,7 +3,14 @@ private: false
 default_branch: "main"
 default_delete_branch_after_merge: true
 default_merge_style: "squash"
-# branch_protection is intentionally omitted on creation: the required Woodpecker
-# status checks do not exist until the repo is created and its first pipeline
-# runs, so requiring them up front would block the very first PR. Add protection
-# in a follow-up PR (mirroring node-lookup.yaml) once CI is green.
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"
+    approval_whitelist_users:
+      - "benvin"