diff --git a/.asf.yaml b/.asf.yaml
index a7bd5b637..421b3572a 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -49,7 +49,7 @@ github:
   dependabot_alerts: true
   dependabot_updates: false
 
-  # --- OPTIONAL self-serve branch protection (enable once the project agrees on required checks) ----
+  # --- Branch protection: 1 approving review + green CI required to merge to master -----------------
   protected_branches:
      master:
        required_pull_request_reviews:
@@ -57,6 +57,7 @@ github:
          dismiss_stale_reviews: true
        required_status_checks:
          strict: true
+         # Contexts must be check-run (job) names as reported to GitHub, not workflow names.
          contexts:
            - Code Quality
            - Security Checks