diff --git a/.circleci/config.pkl b/.circleci/config.pkl
index c1b9cc28..8a447145 100644
--- a/.circleci/config.pkl
+++ b/.circleci/config.pkl
@@ -53,6 +53,44 @@ main {
   }
 }
 
+// TODO: remove me once policy allows these jobs without approval
+circleCi {
+  workflows {
+    ["release-branch"] {
+      jobs = new Listing<*Mapping<String, WorkflowJob>|String> {
+        new {
+          ["hold"] {
+            type = "approval"
+          }
+        }
+        new {
+          ["pr-approval/authenticate"] {
+            context = "pkl-pr-approval"
+          }
+        }
+        for (job in super.jobs) {
+          job |> requireApproval
+        }
+      }
+    }
+  }
+}
+
+// TODO: remove me once policy allows these jobs without approval
+local requireApproval = (it: String|Mapping<String, WorkflowJob>) ->
+  if (it is String)
+    new Mapping<String, WorkflowJob> {
+      [it] {
+        requires { "hold" }
+      }
+    }
+  else
+    (it) {
+      [it.keys.first] {
+        requires { "hold" }
+      }
+    }
+
 release {
   jobs {
     ...releaseJobs
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 9d866677..c6a700da 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -889,15 +889,37 @@ workflows:
             only: /^v?\d+\.\d+\.\d+$/
   release-branch:
     jobs:
-    - gradle-check-jdk11
-    - gradle-check-jdk17
-    - check-patch-file
-    - bench
-    - pkl-cli-macOS-amd64-release
-    - pkl-cli-linux-amd64-release
-    - pkl-cli-macOS-aarch64-release
-    - pkl-cli-linux-aarch64-release
-    - pkl-cli-linux-alpine-amd64-release
+    - hold:
+        type: approval
+    - pr-approval/authenticate:
+        context: pkl-pr-approval
+    - gradle-check-jdk11:
+        requires:
+        - hold
+    - gradle-check-jdk17:
+        requires:
+        - hold
+    - check-patch-file:
+        requires:
+        - hold
+    - bench:
+        requires:
+        - hold
+    - pkl-cli-macOS-amd64-release:
+        requires:
+        - hold
+    - pkl-cli-linux-amd64-release:
+        requires:
+        - hold
+    - pkl-cli-macOS-aarch64-release:
+        requires:
+        - hold
+    - pkl-cli-linux-aarch64-release:
+        requires:
+        - hold
+    - pkl-cli-linux-alpine-amd64-release:
+        requires:
+        - hold
     when:
       matches:
         value: << pipeline.git.branch >>