diff --git a/.github/settings.yml b/.github/settings.yml
index 50a51aff..107aa0ad 100644
--- a/.github/settings.yml
+++ b/.github/settings.yml
@@ -13,23 +13,14 @@ repository:
 branches:
   - name: main
     protection:
-      required_pull_request_reviews:
-        required_pull_request_review_count: 1
-        dismiss_stale_reviews: true
-        require_code_owner_reviews: true
-      restrictions:
-        teams:
-          - "npm/cli-team"
-      enforce_admins: true
       required_status_checks: null
-  - name: latest
-    protection:
+      enforce_admins: true
       required_pull_request_reviews:
-        required_pull_request_review_count: 1
-        dismiss_stale_reviews: true
+        required_approving_review_count: 1
         require_code_owner_reviews: true
+        require_last_push_approval: true
+        dismiss_stale_reviews: true
       restrictions:
-        teams:
-          - "npm/cli-team"
-      enforce_admins: true
-      required_status_checks: null
+        apps: []
+        users: []
+        teams: [ "cli-team" ]
diff --git a/lib/content/settings.yml b/lib/content/settings.yml
index c61f1edf..0f90cec6 100644
--- a/lib/content/settings.yml
+++ b/lib/content/settings.yml
@@ -9,16 +9,16 @@ repository:
   enable_vulnerability_alerts: true
 
 branches:
-  {{#each branches}}
-  - name: {{ . }}
+  - name: {{ defaultBranch }}
     protection:
+      required_status_checks: null
+      enforce_admins: true
       required_pull_request_reviews:
-        required_pull_request_review_count: 1
-        dismiss_stale_reviews: true
+        required_approving_review_count: 1
         require_code_owner_reviews: true
+        require_last_push_approval: true
+        dismiss_stale_reviews: true
       restrictions:
-        teams:
-          - "npm/cli-team"
-      enforce_admins: true
-      required_status_checks: null
-  {{/each}}
+        apps: []
+        users: []
+        teams: ["cli-team"]
diff --git a/tap-snapshots/test/apply/source-snapshots.js.test.cjs b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
index efb62ed0..4a101dfa 100644
--- a/tap-snapshots/test/apply/source-snapshots.js.test.cjs
+++ b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
@@ -180,26 +180,17 @@ repository:
 branches:
   - name: main
     protection:
-      required_pull_request_reviews:
-        required_pull_request_review_count: 1
-        dismiss_stale_reviews: true
-        require_code_owner_reviews: true
-      restrictions:
-        teams:
-          - "npm/cli-team"
-      enforce_admins: true
       required_status_checks: null
-  - name: latest
-    protection:
+      enforce_admins: true
       required_pull_request_reviews:
-        required_pull_request_review_count: 1
-        dismiss_stale_reviews: true
+        required_approving_review_count: 1
         require_code_owner_reviews: true
+        require_last_push_approval: true
+        dismiss_stale_reviews: true
       restrictions:
-        teams:
-          - "npm/cli-team"
-      enforce_admins: true
-      required_status_checks: null
+        apps: []
+        users: []
+        teams: [ "cli-team" ]
 
 .github/workflows/audit.yml
 ========================================
@@ -1625,26 +1616,17 @@ repository:
 branches:
   - name: main
     protection:
-      required_pull_request_reviews:
-        required_pull_request_review_count: 1
-        dismiss_stale_reviews: true
-        require_code_owner_reviews: true
-      restrictions:
-        teams:
-          - "npm/cli-team"
-      enforce_admins: true
       required_status_checks: null
-  - name: latest
-    protection:
+      enforce_admins: true
       required_pull_request_reviews:
-        required_pull_request_review_count: 1
-        dismiss_stale_reviews: true
+        required_approving_review_count: 1
         require_code_owner_reviews: true
+        require_last_push_approval: true
+        dismiss_stale_reviews: true
       restrictions:
-        teams:
-          - "npm/cli-team"
-      enforce_admins: true
-      required_status_checks: null
+        apps: []
+        users: []
+        teams: [ "cli-team" ]
 
 .github/workflows/audit.yml
 ========================================
@@ -3346,26 +3328,17 @@ repository:
 branches:
   - name: main
     protection:
-      required_pull_request_reviews:
-        required_pull_request_review_count: 1
-        dismiss_stale_reviews: true
-        require_code_owner_reviews: true
-      restrictions:
-        teams:
-          - "npm/cli-team"
-      enforce_admins: true
       required_status_checks: null
-  - name: latest
-    protection:
+      enforce_admins: true
       required_pull_request_reviews:
-        required_pull_request_review_count: 1
-        dismiss_stale_reviews: true
+        required_approving_review_count: 1
         require_code_owner_reviews: true
+        require_last_push_approval: true
+        dismiss_stale_reviews: true
       restrictions:
-        teams:
-          - "npm/cli-team"
-      enforce_admins: true
-      required_status_checks: null
+        apps: []
+        users: []
+        teams: [ "cli-team" ]
 
 .github/workflows/ci-a.yml
 ========================================