diff --git a/.github/workflows/sdk_generation.yaml b/.github/workflows/sdk_generation.yaml
index 468a376..5015e2b 100644
--- a/.github/workflows/sdk_generation.yaml
+++ b/.github/workflows/sdk_generation.yaml
@@ -79,8 +79,10 @@ jobs:
           if [ -n "$FEATURE_BRANCH_INPUT" ]; then
             # SDK PRs must come from a reviewable feature branch, never a
             # protected ref or an option-looking / metacharacter name.
+            # refs/* is blocked too: "refs/heads/main" would bypass the
+            # literal main check and force-push the default branch.
             case "$FEATURE_BRANCH_INPUT" in
-              main|master|release/*|-*|*[!a-zA-Z0-9._/-]*)
+              main|master|release/*|refs/*|-*|*[!a-zA-Z0-9._/-]*)
                 echo "::error::Invalid feature_branch '$FEATURE_BRANCH_INPUT'"
                 exit 1
                 ;;