diff --git a/roles/distgit/pagure/templates/pagure_shared.cfg b/roles/distgit/pagure/templates/pagure_shared.cfg
index 100dfdf4b3..ca14aec4dc 100644
--- a/roles/distgit/pagure/templates/pagure_shared.cfg
+++ b/roles/distgit/pagure/templates/pagure_shared.cfg
@@ -77,6 +77,21 @@ ACL_BLOCK_UNSPECIFIED = False
 ACL_PROTECTED_NAMESPACES = ['rpms', 'modules', 'container']
 RCM_GROUP = 'relenggroup'
 RCM_BRANCHES = ['refs/heads/f[0-9]+', 'refs/tags/.*', 'refs/heads/.*']
+{% if env == 'staging' %}
+# Pushing to c* stuff and master is never allowed
+BLACKLIST_RES = ['refs/heads/c[0-9]+.*']
+# Pushing to (f|epel|el|olpc)(num+) that is not previously approved
+# (supported branches, ie: configured and active in PDC) is not allowed.
+UNSPECIFIED_BLACKLIST_RES = ['refs/heads/main',
+                             'refs/heads/rawhide',
+                             'refs/heads/f[0-9]+',
+                             'refs/heads/epel[0-9]+',
+                             'refs/heads/el[0-9]+',
+                             'refs/heads/olpc[0-9]+',
+# master branch is used only for modules
+# See https://pagure.io/releng/issue/10139#comment-741194
+                             'refs/heads/master']
+{% else %}
 # Pushing to c* stuff and master is never allowed
 BLACKLIST_RES = ['refs/heads/c[0-9]+.*', 'refs/heads/master']
 # Pushing to (f|epel|el|olpc)(num+) that is not previously approved
@@ -87,6 +102,8 @@ UNSPECIFIED_BLACKLIST_RES = ['refs/heads/main',
                              'refs/heads/epel[0-9]+',
                              'refs/heads/el[0-9]+',
                              'refs/heads/olpc[0-9]+']
+{% endif %}
+
 PDC_BRANCH_OVERRIDES = {"rpms": {"refs/heads/main": "refs/heads/rawhide"}}