diff --git a/gitea-branch-protection.sh b/gitea-branch-protection.sh
new file mode 100644
index 0000000..930d9e5
--- /dev/null
+++ b/gitea-branch-protection.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+# Apply branch protections to all repositories
+# Requires GITEA_TOKEN env var
+
+REPOS=("hermes-agent" "the-nexus" "timmy-home" "timmy-config")
+
+for repo in "${REPOS[@]}"
+do
+  curl -X POST "https://forge.alexanderwhitestone.com/api/v1/repos/Timmy_Foundation/$repo/branches/main/protection" \
+    -H "Authorization: token $GITEA_TOKEN" \
+    -H "Content-Type: application/json" \
+    -d '{
+        "required_reviews": 1,
+        "dismiss_stale_reviews": true,
+        "block_force_push": true,
+        "block_deletions": true
+      }'
+done