diff --git a/.github/workflows/main-branch-guard.yml b/.github/workflows/main-branch-guard.yml
new file mode 100644
index 0000000..4f1468e
--- /dev/null
+++ b/.github/workflows/main-branch-guard.yml
@@ -0,0 +1,30 @@
+---
+name: Main Branch Source Guard
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, reopened, synchronize, edited]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  guard:
+    name: Guard main branch source
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify pull request source branch
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+        run: |
+          if [[ "${HEAD_REF}" == "next" || "${HEAD_REF}" == hotfix-* ]]; then
+            echo "Head branch '${HEAD_REF}' is allowed to target main."
+            exit 0
+          fi
+          echo "::error::Pull requests into main must come from 'next' or a 'hotfix-*' branch (got '${HEAD_REF}'). See ADR-0008 (z-shell/.github) for the branching model."
+          exit 1
diff --git a/renovate.json b/renovate.json
index fc1528e..c9dc506 100644
--- a/renovate.json
+++ b/renovate.json
@@ -4,5 +4,6 @@
     "local>z-shell/.github:renovate-config",
     ":dependencyDashboardApproval",
     ":disableVulnerabilityAlerts"
-  ]
+  ],
+  "baseBranches": ["next"]
 }