diff --git a/.circleci/config.yml b/.circleci/config.yml
index 1d07ac9dfe..7f1327477f 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -746,8 +746,21 @@ jobs:
                     "https://circleci.com/api/v1.1/project/github/hashicorp/consul-enterprise/tree/${CIRCLE_BRANCH}" | jq -r '.build_url'
       - run: *notify-slack-failure
 
+  # The noop job is a used as a very fast job in the verify-ci workflow because every workflow
+  # requires at least one job. It does nothing.
+  noop:
+    docker:
+      - image: docker.mirror.hashicorp.services/alpine:latest
+    steps:
+      - run: 'echo ok'
+
 workflows:
   version: 2
+  # verify-ci is a no-op workflow that must run on every PR. It is used in a
+  # branch protection rule to detect when CI workflows are not running.
+  verify-ci:
+    jobs: [noop]
+
   go-tests:
     jobs:
       - check-vendor: &filter-ignore-non-go-branches
@@ -886,3 +899,4 @@ workflows:
             branches:
               only:
                 - master
+                - /release\/\d+\.\d+\.x$/
diff --git a/.circleci/scripts/cherry-picker.sh b/.circleci/scripts/cherry-picker.sh
index e63e05063b..5baf6ca1c7 100755
--- a/.circleci/scripts/cherry-picker.sh
+++ b/.circleci/scripts/cherry-picker.sh
@@ -95,10 +95,11 @@ if [[ "$ret" -ne 0 ]]; then
     exit 0
 fi
 
+git config --local user.email "github-team-consul-core@hashicorp.com"
+git config --local user.name "hc-github-team-consul-core"
+
 # loop through all labels on the PR
 for label in $labels; do
-    git config --local user.email "github-team-consul-core@hashicorp.com"
-    git config --local user.name "hc-github-team-consul-core"
     status "checking label: $label"
     # TODO: enable this when replatform is merged into stable-website
     # if the label matches docs-cherrypick, it will attempt to cherry-pick to stable-website