diff --git a/joint_teapot/__main__.py b/joint_teapot/__main__.py
index 2605c3e..92d9fd7 100644
--- a/joint_teapot/__main__.py
+++ b/joint_teapot/__main__.py
@@ -29,8 +29,8 @@ def create_personal_repos_for_all_canvas_students() -> None:
 
 
 @app.command("create-teams", help="create teams on gitea by canvas groups")
-def create_teams_and_repos_by_canvas_groups() -> None:
-    teapot.create_teams_and_repos_by_canvas_groups()
+def create_teams_and_repos_by_canvas_groups(group_prefix: str) -> None:
+    teapot.create_teams_and_repos_by_canvas_groups(group_prefix)
 
 
 @app.command("get-public-keys", help="list all public keys on gitea")
diff --git a/joint_teapot/teapot.py b/joint_teapot/teapot.py
index 5603d1f..781ab22 100644
--- a/joint_teapot/teapot.py
+++ b/joint_teapot/teapot.py
@@ -1,6 +1,6 @@
 import functools
 from datetime import datetime
-from typing import Any, Callable, List
+from typing import Any, Callable, List, Optional
 
 from joint_teapot.config import settings
 from joint_teapot.utils.logger import logger
@@ -67,8 +67,12 @@ class Teapot:
             self.canvas.students
         )
 
-    def create_teams_and_repos_by_canvas_groups(self) -> List[str]:
-        def convertor(name: str) -> str:
+    def create_teams_and_repos_by_canvas_groups(
+        self, group_prefix: str = ""
+    ) -> List[str]:
+        def convertor(name: str) -> Optional[str]:
+            if group_prefix and not name.startswith(group_prefix):
+                return None
             team_name, number_str = name.split(" ")
             number = int(number_str)
             return f"{team_name}-{number:02}"
diff --git a/joint_teapot/workers/gitea.py b/joint_teapot/workers/gitea.py
index c1226a0..37b6413 100644
--- a/joint_teapot/workers/gitea.py
+++ b/joint_teapot/workers/gitea.py
@@ -200,6 +200,7 @@ class Gitea:
                 team.id, self.org_name, repo_name
             )
             membership: GroupMembership
+            student_count = 0
             for membership in group.get_memberships():
                 student = first(students, lambda s: s.id == membership.user_id)
                 if student is None:
@@ -211,6 +212,40 @@ class Gitea:
                 self.repository_api.repo_add_collaborator(
                     self.org_name, repo_name, username
                 )
+                student_count += 1
+            try:
+                self.repository_api.repo_delete_branch_protection(
+                    self.org_name, repo_name, "master"
+                )
+            except ApiException as e:
+                if e.status != 404:
+                    raise
+            self.repository_api.repo_create_branch_protection(
+                self.org_name,
+                repo_name,
+                body={
+                    "block_on_official_review_requests": True,
+                    "block_on_outdated_branch": True,
+                    "block_on_rejected_reviews": True,
+                    "branch_name": "master",
+                    "dismiss_stale_approvals": True,
+                    "enable_approvals_whitelist": False,
+                    "enable_merge_whitelist": False,
+                    "enable_push": False,
+                    "enable_push_whitelist": False,
+                    "enable_status_check": False,
+                    "merge_whitelist_teams": [],
+                    "merge_whitelist_usernames": [],
+                    "protected_file_patterns": "",
+                    "push_whitelist_deploy_keys": False,
+                    "push_whitelist_teams": [],
+                    "push_whitelist_usernames": [],
+                    "require_signed_commits": False,
+                    "required_approvals": max(student_count - 1, 0),
+                    "status_check_contexts": [],
+                },
+            )
+            logger.info(f"{self.org_name}/{repo_name} jobs done")
         return repo_names
 
     def get_public_key_of_canvas_students(self, students: PaginatedList) -> List[str]: