diff --git a/.github/rulesets/default-main-protection.json b/.github/rulesets/default-main-protection.json
new file mode 100644
index 00000000..606e94f2
--- /dev/null
+++ b/.github/rulesets/default-main-protection.json
@@ -0,0 +1,47 @@
+{
+  "name": "default-main-protection",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "required_reviewers": [],
+        "require_code_owner_review": false,
+        "dismissal_restriction": {
+          "enabled": false,
+          "allowed_actors": []
+        },
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": true,
+        "require_extra_approval_for_unattributed_changes": true,
+        "allowed_merge_methods": ["merge", "squash", "rebase"]
+      }
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "required_status_checks": [
+          {
+            "context": "Swift CI / compile (macOS)"
+          }
+        ]
+      }
+    }
+  ]
+}
diff --git a/.github/workflows/mac-release.yml b/.github/workflows/mac-release.yml
index fd6c8757..4b2a93d6 100644
--- a/.github/workflows/mac-release.yml
+++ b/.github/workflows/mac-release.yml
@@ -55,7 +55,17 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  compile:
+    name: compile (macOS)
+    if: github.event.repository.fork == false
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Swift compile gate
+        run: swift build
+
   release:
+    needs: compile
     if: github.event.repository.fork == false
     runs-on: macos-latest
     timeout-minutes: 60
diff --git a/.github/workflows/swift-ci.yml b/.github/workflows/swift-ci.yml
index ce3e08aa..3fff8d67 100644
--- a/.github/workflows/swift-ci.yml
+++ b/.github/workflows/swift-ci.yml
@@ -22,7 +22,16 @@ env:
   SCHEME: CodeCapsCompanion
 
 jobs:
+  compile:
+    name: compile (macOS)
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Swift compile gate
+        run: swift build
+
   package:
+    needs: compile
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v7
@@ -41,6 +50,7 @@ jobs:
           if-no-files-found: warn
 
   companion:
+    needs: compile
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v7
diff --git a/scripts/apply-main-compile-gate-ruleset.sh b/scripts/apply-main-compile-gate-ruleset.sh
new file mode 100755
index 00000000..80d1a62f
--- /dev/null
+++ b/scripts/apply-main-compile-gate-ruleset.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo="${1:-Simple-With-Us/CodeCaps}"
+ruleset_id="${2:-24433457}"
+config="${3:-$(cd "$(dirname "$0")/.." && pwd)/.github/rulesets/default-main-protection.json}"
+
+if [[ ! -f "$config" ]]; then
+  echo "ruleset config not found: $config" >&2
+  exit 1
+fi
+
+gh api "repos/${repo}/rulesets/${ruleset_id}" -X PUT --input "$config"
+echo "Updated ruleset ${ruleset_id} on ${repo} (required: Swift CI / compile (macOS))."