diff --git a/.asf.yaml b/.asf.yaml
index a7bd5b637..aebcc7b97 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -1,4 +1,4 @@
-# .asf.yaml — Apache Infra self-service config for github.com/apache/caldera
+# .asf.yaml: Apache Infra self-service config for github.com/apache/caldera
 # Reference: https://github.com/apache/infrastructure-asfyaml  ·  https://infra.apache.org/asf-yaml.html
 # This file lives at the repo ROOT and its `notifications:` block ONLY takes effect on the
 # DEFAULT branch (master). Repo metadata/features (github:) are not branch-specific.
@@ -19,7 +19,7 @@ notifications:
 github:
   description: "Automated Adversary Emulation Platform"
   homepage: https://caldera.apache.org/       # update from the old caldera.mitre.org
-  # NOTE: `labels:` REPLACES the repo's GitHub topics wholesale — keep the list intentional.
+  # NOTE: `labels:` REPLACES the repo's GitHub topics wholesale, so keep the list intentional.
   labels:
     - adversary-emulation
     - security-automation
@@ -49,7 +49,7 @@ github:
   dependabot_alerts: true
   dependabot_updates: false
 
-  # --- OPTIONAL self-serve branch protection (enable once the project agrees on required checks) ----
+  # --- Branch protection: 1 approving review + green CI required to merge to master -----------------
   protected_branches:
      master:
        required_pull_request_reviews:
@@ -57,11 +57,16 @@ github:
          dismiss_stale_reviews: true
        required_status_checks:
          strict: true
+         # Contexts are check-run (job) names as reported to GitHub, not workflow
+         # names. Require the hand-named aggregate job in each workflow rather than
+         # the generated "build (<python>, <toxenv>)" legs: those are renamed by any
+         # matrix edit, and a required context that stops reporting blocks every
+         # merge until Infra removes it by hand.
          contexts:
-           - Code Quality
-           - Security Checks
+           - ci-required        # .github/workflows/quality.yml,  gates the 4 python legs
+           - security-required  # .github/workflows/security.yml, gates safety + bandit
        required_conversation_resolution: true
-  #     # required_signatures: true    # only if all committers sign commits — can block merges otherwise
+  #     # required_signatures: true    # only if all committers sign commits; can block merges otherwise
   copilot_code_review:
     enabled: true
     review_drafts: false
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index d88c31a01..ed2bd1a18 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -116,3 +116,20 @@ jobs:
           path: sonar-fork-pr-artifact/
           retention-days: 3
           if-no-files-found: warn
+
+  # Stable aggregate context for the .asf.yaml branch protection on master.
+  # Required status checks match check-run names, and the matrix legs report as
+  # "build (<python>, <toxenv>)", so every matrix edit renames them and the old
+  # name then silently never reports, wedging all merges until Infra intervenes.
+  # This job's name is hand-written, so it survives matrix changes.
+  ci-required:
+    # always() so a failed matrix still runs this job: a skipped job counts as a
+    # satisfied required check, which would quietly disable the protection.
+    if: always()
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify every matrix leg passed
+        run: |
+          echo "build result: ${{ needs.build.result }}"
+          [ "${{ needs.build.result }}" = "success" ]
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 6141102e9..486021a0a 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -36,3 +36,18 @@ jobs:
         env:
           TOXENV: ${{ matrix.toxenv }}
         run: tox
+
+  # Stable aggregate context for the .asf.yaml branch protection on master.
+  # See the matching ci-required job in quality.yml for why the generated
+  # "build (<python>, <toxenv>)" names must not be required directly.
+  security-required:
+    # always() so a failed matrix still runs this job: a skipped job counts as a
+    # satisfied required check, which would quietly disable the protection.
+    if: always()
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify every matrix leg passed
+        run: |
+          echo "build result: ${{ needs.build.result }}"
+          [ "${{ needs.build.result }}" = "success" ]