diff --git a/.github/rulesets/main.json b/.github/rulesets/main.json
new file mode 100644
index 0000000..98d3035
--- /dev/null
+++ b/.github/rulesets/main.json
@@ -0,0 +1,58 @@
+{
+  "name": "main",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "exclude": [],
+      "include": [
+        "~DEFAULT_BRANCH"
+      ]
+    }
+  },
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "required_linear_history"
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false,
+        "allowed_merge_methods": [
+          "squash",
+          "rebase"
+        ]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          {
+            "context": "checks",
+            "integration_id": 15368
+          }
+        ]
+      }
+    },
+    {
+      "type": "non_fast_forward"
+    }
+  ],
+  "bypass_actors": [
+    {
+      "actor_id": 5,
+      "actor_type": "RepositoryRole",
+      "bypass_mode": "always"
+    }
+  ]
+}
diff --git a/README.md b/README.md
index 299416e..3e65d59 100644
--- a/README.md
+++ b/README.md
@@ -287,6 +287,7 @@ format-source # format code source
 install # run install tasks
 install-hooks # install git hooks
 install-project # install the project
+install-rulesets # install github rulesets
 
 [mlflow]
 mlflow # run mlflow tasks
diff --git a/tasks/install.just b/tasks/install.just
index e1392f1..e8a74df 100644
--- a/tasks/install.just
+++ b/tasks/install.just
@@ -12,3 +12,13 @@ install-hooks:
 [group('install')]
 install-project:
     uv sync --all-groups
+
+# install github rulesets
+[group('install')]
+install-rulesets:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    repo=$(gh repo view --json=name --jq=.name)
+    owner=$(gh repo view --json=owner --jq=.owner.login)
+    gh api --method POST -H "Accept: application/vnd.github+json" \
+    "/repos/$owner/$repo/rulesets" --input=".github/rulesets/main.json"