diff --git a/tests/base.py b/tests/base.py
index 548c011402..ffdf321526 100644
--- a/tests/base.py
+++ b/tests/base.py
@@ -246,7 +246,7 @@ def driver_config(driver, **kw):
         if driver_dict is None:
             driver_dict = {}
             test.__driver_config__ = driver_dict
-        driver_dict[driver] == kw
+        driver_dict[driver] = kw
         return test
     return decorator
 
@@ -382,6 +382,7 @@ class GithubDriverMock(GithubDriver):
                  additional_event_queues, git_url_with_auth):
         super(GithubDriverMock, self).__init__()
         self.registry = registry
+        self.test_config = test_config
         self.changes = test_config.changes
         self.config = config
         self.upstream_root = upstream_root
diff --git a/tests/fakegithub.py b/tests/fakegithub.py
index 872e9213b8..0e39e2022a 100644
--- a/tests/fakegithub.py
+++ b/tests/fakegithub.py
@@ -1291,8 +1291,17 @@ class FakeGithubClient(object):
 
     def addProject(self, project):
         owner, proj = project.name.split('/')
-        self._data.repos[(owner, proj)] = FakeRepository(
+        repo = FakeRepository(
             project.name, self._data)
+        self._data.repos[(owner, proj)] = repo
+        github_config =\
+            self._data.fake_github_connection.driver.test_config.driver.github
+        if bprs := github_config.get('branch_protection_rules', {}
+                                     ).get(project.name, {}):
+            for branch, rule_configs in bprs.items():
+                for rule_config in rule_configs:
+                    repo._set_branch_protection(
+                        branch, protected=True, **rule_config)
 
     def addProjectByName(self, project_name):
         owner, proj = project_name.split('/')
@@ -1523,7 +1532,8 @@ class FakeGithubConnection(githubconnection.GithubConnection):
     client_manager_class = FakeGithubClientManager
 
     def __init__(self, driver, connection_name, connection_config,
-                 changes_db=None, upstream_root=None, git_url_with_auth=False):
+                 changes_db=None, upstream_root=None,
+                 git_url_with_auth=False):
         super(FakeGithubConnection, self).__init__(driver, connection_name,
                                                    connection_config)
         self.connection_name = connection_name
diff --git a/tests/unit/test_github_driver.py b/tests/unit/test_github_driver.py
index eded235da7..1a5d8fdb87 100644
--- a/tests/unit/test_github_driver.py
+++ b/tests/unit/test_github_driver.py
@@ -43,6 +43,7 @@ from tests.base import (
     BaseTestCase,
     ZuulGithubAppTestCase,
     ZuulTestCase,
+    driver_config,
     iterate_timeout,
     okay_tracebacks,
     simple_layout,
@@ -2072,6 +2073,57 @@ class TestGithubLockedBranches(ZuulTestCase):
         self.assertEqual(0, len(tpc2.parsed_branch_config.keys()))
         self.assertEqual(0, len(tpc3.parsed_branch_config.keys()))
 
+    @driver_config('github', branch_protection_rules={
+        'org/project2': {
+            'master': [
+                {'locked': True},
+            ]
+        }
+    })
+    def test_exclude_locked_branches_startup(self):
+        # Make sure that we exclude locked branches on startup as well
+        # (this exercises a different code path in the branch cache).
+        tenant = self.scheds.first.sched.abide.tenants\
+            .get('tenant-one')
+
+        project1 = list(tenant.untrusted_projects)[0]
+        project2 = list(tenant.untrusted_projects)[1]
+        project3 = list(tenant.untrusted_projects)[2]
+
+        tpc1 = tenant.project_configs[project1.canonical_name]
+        tpc2 = tenant.project_configs[project2.canonical_name]
+        tpc3 = tenant.project_configs[project3.canonical_name]
+
+        # project 1 should have parsed master
+        self.assertIn('master', tpc1.parsed_branch_config.keys())
+        # project 1 should not have a master branch because it's locked
+        self.assertEqual(0, len(tpc2.parsed_branch_config.keys()))
+        # project 3 should not because it excludes unprotected
+        self.assertEqual(0, len(tpc3.parsed_branch_config.keys()))
+
+
+class TestGithubLockedBranchesValidation(ZuulTestCase):
+    config_file = 'zuul-github-driver.conf'
+    tenant_config_file = 'config/locked-branches/main.yaml'
+    scheduler_count = 1
+    validate_tenants = ['tenant-one']
+
+    @driver_config('github', branch_protection_rules={
+        'org/project2': {
+            'master': [
+                {'locked': True},
+            ]
+        }
+    })
+    def test_exclude_locked_branches_validation(self):
+        self.assertEqual(2, len(self.merge_job_history['cat']))
+        projects = {
+            x.payload['project']
+            for x in self.merge_job_history['cat']
+        }
+        self.assertEqual({'org/common-config', 'org/project1'},
+                         projects)
+
 
 class TestGithubWebhook(ZuulTestCase):
     config_file = 'zuul-github-driver.conf'