diff --git a/tests/unit/test_github_driver.py b/tests/unit/test_github_driver.py
index adf7ffa581..d20ffc523b 100644
--- a/tests/unit/test_github_driver.py
+++ b/tests/unit/test_github_driver.py
@@ -2069,6 +2069,43 @@ class TestGithubUnprotectedBranches(ZuulTestCase):
             self.waitUntilSettled()
             cache_mock.assert_not_called()
 
+    def test_push_event_unprotected_branch_cache_update(self):
+        # Test that we do not update the branch cache for events on
+        # unprotected branches when exclude-unprotected-branches is
+        # configured.
+        self.create_branch('org/project2', 'feature')
+        github = self.fake_github.getGithubClient()
+        repo = github.repo_from_project('org/project2')
+        repo._set_branch_protection('master', True)
+        repo._create_branch('feature')
+
+        with (mock.patch(
+                "zuul.zk.branch_cache_new.BranchCacheNew.setProtected")
+              as cache_mock):
+            self.fake_github.emitEvent(
+                self.fake_github.getPushEvent(
+                    'org/project2',
+                    ref='refs/heads/feature'))
+            self.waitUntilSettled()
+            cache_mock.assert_not_called()
+
+    def test_push_event_protected_branch_cache_update(self):
+        # Test that we do not update the branch cache for events on
+        # protected branches when the protected state did not change.
+        github = self.fake_github.getGithubClient()
+        repo = github.repo_from_project('org/project2')
+        repo._set_branch_protection('master', True)
+
+        with (mock.patch(
+                "zuul.zk.branch_cache_new.BranchCacheNew.setProtected")
+              as cache_mock):
+            self.fake_github.emitEvent(
+                self.fake_github.getPushEvent(
+                    'org/project2',
+                    ref='refs/heads/master'))
+            self.waitUntilSettled()
+            cache_mock.assert_not_called()
+
     def _test_push_event_reconfigure(self, project, branch,
                                      expect_reconfigure=False,
                                      old_sha=None, new_sha=None,
diff --git a/zuul/connection/__init__.py b/zuul/connection/__init__.py
index 5e28d46901..6d2904de0b 100644
--- a/zuul/connection/__init__.py
+++ b/zuul/connection/__init__.py
@@ -526,8 +526,15 @@ class ZKBranchCacheMixin:
                 project_name, required_flags, default=None)
 
             if branches is not None:
-                if ((branch_info := branches.get(event.branch)) is None or
-                        branch_info.protected != protected):
+                if (
+                    # We have information about that branch and the
+                    # protected state changed ...
+                    ((branch_info := branches.get(event.branch))
+                        and branch_info.protected != protected)
+                    # ... OR we don't have any branch info, but the
+                    # branch is now protected
+                    or (branch_info is None and protected)
+                ):
                     log = get_annotated_logger(self.log, event)
                     log.info("Project %s branch %s protected state "
                              "changed to %s",