diff --git a/.github/workflows/health-40-sweep.yml b/.github/workflows/health-40-sweep.yml
index 68cf862a19..568298915c 100644
--- a/.github/workflows/health-40-sweep.yml
+++ b/.github/workflows/health-40-sweep.yml
@@ -6,7 +6,7 @@ on:
     - cron: '5 5 * * 1'
   pull_request:
   push:
-    branches: [phase-2-dev]
+    branches: [phase-2-dev, main]
     paths:
       - '.github/workflows/**/*.yml'
 
diff --git a/.github/workflows/health-43-ci-signature-guard.yml b/.github/workflows/health-43-ci-signature-guard.yml
index d8fe9b3a14..e812fa6a5f 100644
--- a/.github/workflows/health-43-ci-signature-guard.yml
+++ b/.github/workflows/health-43-ci-signature-guard.yml
@@ -2,13 +2,13 @@ name: Health 43 CI Signature Guard
 
 on:
   push:
-    branches: [ phase-2-dev ]
+    branches: [ phase-2-dev, main ]
     paths:
       - .github/workflows/pr-00-gate.yml
       - .github/signature-fixtures/**
       - .github/actions/signature-verify/**
   pull_request:
-    branches: [ phase-2-dev ]
+    branches: [ phase-2-dev, main ]
     paths:
       - .github/workflows/pr-00-gate.yml
       - .github/signature-fixtures/**
diff --git a/agents/codex-3077.md b/agents/codex-3077.md
new file mode 100644
index 0000000000..a2f477c789
--- /dev/null
+++ b/agents/codex-3077.md
@@ -0,0 +1 @@
+<!-- bootstrap for codex on issue #3077 -->
diff --git a/docs/ci/BRANCHING.md b/docs/ci/BRANCHING.md
new file mode 100644
index 0000000000..19407a5a43
--- /dev/null
+++ b/docs/ci/BRANCHING.md
@@ -0,0 +1,5 @@
+# Branching and workflow triggers
+
+When guards or health workflows specify explicit branch filters, list both the current default branch and `phase-2-dev`. This keeps protections active if the default branch changes.
+
+During any default-branch rename, audit the workflow triggers under `.github/workflows/` and update branch lists accordingly before completing the rename.