diff --git a/.github/workflows/apply-admin-safe-settings.yml b/.github/workflows/apply-admin-safe-settings.yml
new file mode 100644
index 0000000..4998d45
--- /dev/null
+++ b/.github/workflows/apply-admin-safe-settings.yml
@@ -0,0 +1,22 @@
+name: Apply Admin Safe Settings
+on:
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: Whether to run in `dry-run` mode or not
+        required: false
+        type: boolean
+        default: true
+
+permissions: {}
+
+jobs:
+  apply-safe-settings:
+    permissions:
+      contents: read
+    # This is required to work with environment secrets in the called workflow
+    secrets: inherit # zizmor: ignore[secrets-inherit]
+    uses: ./.github/workflows/libsafe-settings.yml
+    with:
+      config-path: admin-safe-settings
+      dry-run: ${{ inputs.dry-run }}
diff --git a/admin-safe-settings/deployment-settings.yml b/admin-safe-settings/deployment-settings.yml
new file mode 100644
index 0000000..b1e2600
--- /dev/null
+++ b/admin-safe-settings/deployment-settings.yml
@@ -0,0 +1,3 @@
+restrictedRepos:
+  include:
+    - .github
diff --git a/admin-safe-settings/suborgs/baseline.yml b/admin-safe-settings/suborgs/baseline.yml
new file mode 100644
index 0000000..aada0f3
--- /dev/null
+++ b/admin-safe-settings/suborgs/baseline.yml
@@ -0,0 +1,49 @@
+# See https://github.com/github/safe-settings/blob/main-enterprise/docs/sample-settings/suborg.yml
+# for example layout
+
+suborgrepos:
+  - '*'
+
+environments:
+  - name: production
+    deployment_branch_policy:
+      protected_branches: false
+      custom_branch_policies:
+        - names: [master]
+          type: branch
+    wait_timer: 0
+    variables:
+      - name: SAFE_SETTINGS_APP_ID
+        value: '2650975'
+  - name: test
+    variables:
+      - name: SAFE_SETTINGS_APP_ID
+        value: '3020872'
+
+rulesets:
+  - name: Prevent destruction of the default branch
+    target: branch
+    enforcement: active
+    conditions:
+      ref_name:
+        include:
+          - ~DEFAULT_BRANCH
+        exclude: []
+    rules:
+      - type: deletion
+      - type: non_fast_forward
+  - name: Require status checks before updating the default branch
+    target: branch
+    enforcement: active
+    conditions:
+      ref_name:
+        include:
+          - ~DEFAULT_BRANCH
+        exclude: []
+    rules:
+      - type: required_status_checks
+        parameters:
+          required_status_checks:
+            - context: Release / Collect results
+              integration_id: 15368
+          strict_required_status_checks_policy: false