diff --git a/.changeset/spotty-towns-show.md b/.changeset/spotty-towns-show.md
new file mode 100644
index 0000000000..8ec69f3f5e
--- /dev/null
+++ b/.changeset/spotty-towns-show.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend-module-github': patch
+---
+
+Made "github:branch-protection:create" action idempotent
diff --git a/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.ts b/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.ts
index 6de447541b..ae8965ef9a 100644
--- a/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.ts
+++ b/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.ts
@@ -130,29 +130,40 @@ export function createGithubBranchProtectionAction(options: {
       });
       const client = new Octokit(octokitOptions);
 
-      const repository = await client.rest.repos.get({
-        owner: owner,
-        repo: repo,
+      const defaultBranch = await ctx.checkpoint({
+        key: `read.default.branch.${owner}.${repo}`,
+        fn: async () => {
+          const repository = await client.rest.repos.get({
+            owner: owner,
+            repo: repo,
+          });
+          return repository.data.default_branch;
+        },
       });
 
-      await enableBranchProtectionOnDefaultRepoBranch({
-        repoName: repo,
-        client,
-        owner,
-        logger: ctx.logger,
-        requireCodeOwnerReviews,
-        bypassPullRequestAllowances,
-        requiredApprovingReviewCount,
-        restrictions,
-        requiredStatusCheckContexts,
-        requireBranchesToBeUpToDate,
-        requiredConversationResolution,
-        requireLastPushApproval,
-        defaultBranch: branch ?? repository.data.default_branch,
-        enforceAdmins,
-        dismissStaleReviews,
-        requiredCommitSigning,
-        requiredLinearHistory,
+      await ctx.checkpoint({
+        key: `enable.branch.protection.${owner}.${repo}`,
+        fn: async () => {
+          await enableBranchProtectionOnDefaultRepoBranch({
+            repoName: repo,
+            client,
+            owner,
+            logger: ctx.logger,
+            requireCodeOwnerReviews,
+            bypassPullRequestAllowances,
+            requiredApprovingReviewCount,
+            restrictions,
+            requiredStatusCheckContexts,
+            requireBranchesToBeUpToDate,
+            requiredConversationResolution,
+            requireLastPushApproval,
+            defaultBranch: branch ?? defaultBranch,
+            enforceAdmins,
+            dismissStaleReviews,
+            requiredCommitSigning,
+            requiredLinearHistory,
+          });
+        },
       });
     },
   });