diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 64429ae..6a44085 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,6 +27,8 @@ jobs:
     name: Lint PR Title
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@v5
         env:
diff --git a/Makefile b/Makefile
index 10eb955..2181d7c 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@ VERSION ?= dev
 COMMIT  ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
 LDFLAGS := -X 'main.version=$(VERSION)' -X 'main.commit=$(COMMIT)'
 
-dev: generate clean
+dev: setup generate clean
 	WEBKIT_DISABLE_DMABUF_RENDERER=1 wails dev -tags webkit2_41 -loglevel Debug -v 2
 
 build-dev: generate
diff --git a/lefthook.yml b/lefthook.yml
index 94ec238..abb29e7 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -31,6 +31,18 @@ pre-commit:
 pre-push:
   parallel: true
   commands:
+    protect-main:
+      run: |
+        while read local_ref local_sha remote_ref remote_sha; do
+          if [ "$remote_ref" = "refs/heads/main" ]; then
+            echo "Direct push to main is not allowed. Use a pull request instead."
+            exit 1
+          fi
+        done
+      skip:
+        - merge
+        - rebase
+
     go-test:
       glob: "*.go"
       run: go test -tags webkit2_41 -race -count=1 -timeout 120s ./...