diff --git a/.gitea/branch-protection.yml b/.gitea/branch-protection.yml
new file mode 100644
index 0000000..88a78b3
--- /dev/null
+++ b/.gitea/branch-protection.yml
@@ -0,0 +1,36 @@
+repos:
+  hermes-agent:
+    branch_protection:
+      require_pull_request: true
+      required_approvals: 1
+      dismiss_stale_reviews: true
+      require_ci_to_pass: true
+      block_force_push: true
+      block_deletion: true
+
+  the-nexus:
+    branch_protection:
+      require_pull_request: true
+      required_approvals: 1
+      dismiss_stale_reviews: true
+      require_ci_to_pass: false # CI runner dead per #915
+      block_force_push: true
+      block_deletion: true
+
+  timmy-home:
+    branch_protection:
+      require_pull_request: true
+      required_approvals: 1
+      dismiss_stale_reviews: true
+      require_ci_to_pass: false # No CI configured
+      block_force_push: true
+      block_deletion: true
+
+  timmy-config:
+    branch_protection:
+      require_pull_request: true
+      required_approvals: 1
+      dismiss_stale_reviews: true
+      require_ci_to_pass: false # Limited CI
+      block_force_push: true
+      block_deletion: true