diff --git a/main.tf b/main.tf
index 367aacd..21fd312 100644
--- a/main.tf
+++ b/main.tf
@@ -53,11 +53,10 @@ locals {
     "tfroot-twilio"            = ["opentofu", "s3-backend", "sms", "sops", "tfstate", "twilio"]
     "www"                      = ["cloudflare", "css", "html", "pwa", "s3", "static-site"]
   }
-  # tfroot-twilio starts with the narrow relaxed profile so its initial PR can
-  # install the OpenTofu workflow before normal required checks are enforced.
+  # Public repositories remain on the relaxed profile only until their initial
+  # pull request has installed the required workflow and centrally managed files.
   relaxed_branch_protection_github_repositories = toset([
-    "agent-knowledge",
-    "tfroot-twilio"
+    "agent-knowledge"
   ])
   # Repositories where automation-created pull requests merge themselves once
   # required checks pass. GitHub auto-merge is enabled only for these
@@ -85,6 +84,7 @@ locals {
     "tfroot-github"            = ["opentofu / test", "opentofu / plan"]
     "tfroot-libvirt"           = ["opentofu / test", "opentofu / plan"]
     "tfroot-namecheap"         = ["opentofu / test", "opentofu / plan"]
+    "tfroot-twilio"            = ["opentofu / test", "opentofu / plan"]
     "www"                      = ["static-checks"]
   }
   secrets = {
diff --git a/moves.tf b/moves.tf
new file mode 100644
index 0000000..321d226
--- /dev/null
+++ b/moves.tf
@@ -0,0 +1,6 @@
+# Graduate tfroot-twilio from the temporary relaxed profile without deleting
+# and recreating its protected main branch.
+moved {
+  from = github_branch_protection.relaxed_protections["tfroot-twilio"]
+  to   = github_branch_protection.protections["tfroot-twilio"]
+}