diff --git a/.asf.yaml b/.asf.yaml
index e21b385c64b..89e624bd26e 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -24,12 +24,25 @@ github:
   enabled_merge_buttons:
     # "squash and merge" replaces committer with noreply@github, and we don't want that
     # See https://lists.apache.org/thread/vxxpt1x316kjryb4dptsbs95p66d9xrv
-    squash:  false
+    squash: false
     # We prefer linear history, so creating merge commits is disabled in UI
-    merge:   false
-    rebase:  true
+    merge: false
+    rebase: true
+  rulesets:
+    - name: "Default Branch Protection"
+      type: branch
+      branches:
+        includes:
+          - "~DEFAULT_BRANCH"
+          - "release/*"
+          - "rel/*"
+        excludes: []
+      bypass_teams:
+        - root
+      restrict_deletion: true
+      restrict_force_push: true
 notifications:
-    commits:      commits@calcite.apache.org
-    issues:       issues@calcite.apache.org
-    pullrequests: commits@calcite.apache.org
-    jira_options: link label
+  commits: commits@calcite.apache.org
+  issues: issues@calcite.apache.org
+  pullrequests: commits@calcite.apache.org
+  jira_options: link label