diff --git a/esti/lakectl_local_test.go b/esti/lakectl_local_test.go
index 21a8861d48b..8898b890e33 100644
--- a/esti/lakectl_local_test.go
+++ b/esti/lakectl_local_test.go
@@ -486,6 +486,111 @@ func TestLakectlLocal_pull(t *testing.T) {
 	}
 }
 
+func TestLakectlLocal_commitProtetedBranch(t *testing.T) {
+	tmpDir := t.TempDir()
+	fd, err := os.CreateTemp(tmpDir, "")
+	require.NoError(t, err)
+	require.NoError(t, fd.Close())
+	repoName := generateUniqueRepositoryName()
+	storage := generateUniqueStorageNamespace(repoName)
+	vars := map[string]string{
+		"REPO":    repoName,
+		"STORAGE": storage,
+		"BRANCH":  mainBranch,
+		"REF":     mainBranch,
+		"PREFIX":  "",
+	}
+
+	runCmd(t, Lakectl()+" repo create lakefs://"+repoName+" "+storage, false, false, vars)
+	runCmd(t, Lakectl()+" log lakefs://"+repoName+"/"+mainBranch, false, false, vars)
+	runCmd(t, Lakectl()+" branch-protect add lakefs://"+repoName+"/ "+mainBranch, false, false, vars)
+	prefix := "images"
+	objects := []string{
+		"ro_1k.1",
+		"ro_1k.2",
+		"ro_1k.3",
+		prefix + "/1.png",
+		prefix + "/2.png",
+		prefix + "/3.png",
+		prefix + "/subdir/1.png",
+		prefix + "/subdir/2.png",
+		prefix + "/subdir/3.png",
+	}
+
+	tests := []struct {
+		name    string
+		prefix  string
+		presign bool
+	}{
+		{
+			name:    "root",
+			prefix:  "",
+			presign: false,
+		},
+		{
+			name:    "root-presign",
+			prefix:  "",
+			presign: true,
+		},
+		{
+			name:    prefix,
+			prefix:  prefix,
+			presign: false,
+		},
+		{
+			name:    prefix + "-presign",
+			prefix:  prefix,
+			presign: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.presign {
+				// Skip due to bug on Azure https://github.com/treeverse/lakeFS/issues/6426
+				requireBlockstoreType(t, block.BlockstoreTypeS3, block.BlockstoreTypeGS)
+			}
+			dataDir, err := os.MkdirTemp(tmpDir, "")
+			require.NoError(t, err)
+			deleted := prefix + "/subdir/deleted.png"
+
+			localCreateTestData(t, vars, append(objects, deleted))
+
+			runCmd(t, Lakectl()+" branch create lakefs://"+repoName+"/"+tt.name+" --source lakefs://"+repoName+"/"+mainBranch, false, false, vars)
+
+			vars["LOCAL_DIR"] = dataDir
+			vars["PREFIX"] = ""
+			vars["BRANCH"] = tt.name
+			vars["REF"] = tt.name
+			presign := fmt.Sprintf(" --pre-sign=%v ", tt.presign)
+			RunCmdAndVerifyContainsText(t, Lakectl()+" local clone lakefs://"+repoName+"/"+vars["BRANCH"]+"/"+vars["PREFIX"]+presign+dataDir, false, "Successfully cloned lakefs://${REPO}/${REF}/${PREFIX} to ${LOCAL_DIR}.", vars)
+
+			RunCmdAndVerifyContainsText(t, Lakectl()+" local status "+dataDir, false, "No diff found", vars)
+
+			// Modify local folder - add and remove files
+			require.NoError(t, os.MkdirAll(filepath.Join(dataDir, "subdir"), os.ModePerm))
+			require.NoError(t, os.MkdirAll(filepath.Join(dataDir, "subdir-a"), os.ModePerm))
+			fd, err = os.Create(filepath.Join(dataDir, "subdir", "test.txt"))
+			require.NoError(t, err)
+			fd, err = os.Create(filepath.Join(dataDir, "subdir-a", "test.txt"))
+			require.NoError(t, err)
+			fd, err = os.Create(filepath.Join(dataDir, "test.txt"))
+			require.NoError(t, err)
+			require.NoError(t, fd.Close())
+			require.NoError(t, os.Remove(filepath.Join(dataDir, deleted)))
+
+			RunCmdAndVerifyContainsText(t, Lakectl()+" local status "+dataDir, false, "local  ║ added   ║ test.txt", vars)
+			RunCmdAndVerifyContainsText(t, Lakectl()+" local status "+dataDir, false, "local  ║ added   ║ subdir/test.txt", vars)
+			RunCmdAndVerifyContainsText(t, Lakectl()+" local status "+dataDir, false, "local  ║ added   ║ subdir-a/test.txt", vars)
+
+			// Commit changes to branch
+			RunCmdAndVerifyContainsText(t, Lakectl()+" local commit -m test"+presign+dataDir, false, "cannot write to protected branch", vars)
+
+			// Check no diff after commit
+			RunCmdAndVerifyContainsText(t, Lakectl()+" local status "+dataDir, false, "No diff found", vars)
+		})
+	}
+
+}
 func TestLakectlLocal_commit(t *testing.T) {
 	tmpDir := t.TempDir()
 	fd, err := os.CreateTemp(tmpDir, "")