--- a/buildfarm/release/release-runner.py
+++ b/buildfarm/release/release-runner.py
@@ -55,43 +55,54 @@ ALL_FILES = set([
     '.exe',
     '.dmg',
     'tar.bz2',
 ])
 
 CONFIGS_WORKDIR = 'buildbot-configs'
 
 
-def check_and_assign_long_revision(release_runner, release):
+def check_and_assign_long_revision(release_runner, release, releases_config):
     # Revisions must be checked before trying to get the long one.
     RevisionsSanitizer(**release).run()
     release['mozillaRevision'] = long_revision(
         release['branch'], release['mozillaRevision'])
 
 
-def assign_and_check_l10n_changesets(release_runner, release):
+def assign_and_check_l10n_changesets(release_runner, release, releases_config):
     release['l10n_changesets'] = parsePlainL10nChangesets(
         release_runner.get_release_l10n(release['name']))
     L10nSanitizer(**release).run()
 
 
-def assign_and_check_partial_updates(release_runner, release):
+def assign_and_check_partial_updates(release_runner, release, releases_config):
     release['partial_updates'] = get_partials(
         release_runner, release['partials'], release['product'])
     branchConfig = get_branch_config(release)
     release['release_channels'] = update_channels(
         release['version'], branchConfig['release_channel_mappings'][release['product']])
     PartialsSanitizer(**release).run()
 
 
+def check_allowed_branches(release_runner, release, releases_config):
+    product = release['product']
+    branch = release['branch']
+    allowed_branches = releases_config[product]['allowed_branches']
+    for pattern in allowed_branches:
+        if re.match(pattern, branch):
+            return
+    raise RuntimeError("%s branch is not allowed: %s", branch, allowed_branches)
+
+
 # So people can't run arbitrary functions
 CHECKS_MAPPING = {
     'long_revision': check_and_assign_long_revision,
     'l10n_changesets': assign_and_check_l10n_changesets,
     'partial_updates': assign_and_check_partial_updates,
+    'check_allowed_branches': check_allowed_branches,
 }
 
 
 def run_prebuild_sanity_checks(release_runner, releases_config):
     new_valid_releases = []
 
     # results in:
     # { 'firefox': ['long_revision', 'l10n_changesets', 'partial_updates']}
@@ -102,17 +113,17 @@ def run_prebuild_sanity_checks(release_r
         try:
             # TODO: this won't work for Thunderbird...do we care?
             release['branchShortName'] = release['branch'].split("/")[-1]
 
             for check in checks[release['product']]:
                 if check not in CHECKS_MAPPING:
                     log.error("Check %s not found", check)
                     continue
-                CHECKS_MAPPING[check](release_runner, release)
+                CHECKS_MAPPING[check](release_runner, release, releases_config)
 
             new_valid_releases.append(release)
         except Exception as e:
             release_runner.mark_as_failed(
                 release, 'Sanity checks failed. Errors: %s' % e)
             log.exception(
                 'Sanity checks failed. Errors: %s. Release: %s', e, release)
     return new_valid_releases

--- a/buildfarm/release/release-runner.yml.example
+++ b/buildfarm/release/release-runner.yml.example
@@ -20,24 +20,34 @@ release-runner:
   masters_json: https://hg.mozilla.org/build/tools/raw-file/default/buildfarm/maintenance/production-masters.json
   sendchange_master: localhost:9001
   staging: false
   verbose: true
   sleeptime: 30
   ssh_username: cltbld
   ssh_key: /home/cltbld/.ssh/release-runner
   docker_worker_key: /home/cltbld/docker-worker-public.pem
-  
+
 symlinks:
   production_config.py: "{buildbot_configs}/mozilla/localconfig.py"
   thunderbird_production_config.py: "{buildbot_configs}/mozilla/thunderbird_localconfig.py"
 
 releases:
   - product: firefox
     pattern: Firefox-.*
     checks:
       - long_revision
       - l10n_changesets
       - partial_updates
+      - check_allowed_branches
+    allowed_branches:
+      - mozilla-beta
+      - mozilla-release
+      - mozilla-esr*
   - product: fennec
     pattern: Fennec-.*
     checks:
       - long_revision
+      - check_allowed_branches
+    allowed_branches:
+      - mozilla-beta
+      - mozilla-release
+      - mozilla-esr*