diff --git a/.github/workflows/branch-cleanup.yml b/.github/workflows/branch-cleanup.yml
index 7aa22a9e..da715e1d 100644
--- a/.github/workflows/branch-cleanup.yml
+++ b/.github/workflows/branch-cleanup.yml
@@ -96,8 +96,15 @@ jobs:
                 ;;
             esac
 
-            # Pull this branch's full PR history (open + closed + merged) in one call.
-            prs_json=$(gh api "repos/$REPO/pulls" -f "head=$OWNER:$branch" -f state=all --jq '.' 2>/dev/null || echo '[]')
+            # Pull this branch's full PR history (open + closed + merged) in one call. --method GET is
+            # required: gh api sends -f fields as a POST body unless told otherwise, which would hit the
+            # create-a-pull-request endpoint instead of listing. When the lookup fails the branch is left
+            # alone: without its PRs the open-PR and protect-label rules cannot be checked.
+            if ! prs_json=$(gh api --method GET "repos/$REPO/pulls" -f "head=$OWNER:$branch" -f state=all -f per_page=100 2>/dev/null); then
+              row "$branch" "Kept" "PR lookup failed" "left alone: its PRs could not be read"
+              kept=$((kept + 1))
+              continue
+            fi
 
             has_open=$(echo "$prs_json" | jq -r 'any(.[]; .state == "open")')
             if [ "$has_open" = "true" ]; then
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 839f30c6..9c6fc1f6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,9 @@ follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+### Fixed (Branch cleanup — `bugfix/147-branch-cleanup-pulls`, #147)
+- The weekly branch cleanup read each branch's pull requests with `gh api -f`, which sends a POST to the create-pull-request endpoint instead of listing, so every lookup failed with 422 and the open-PR and `do-not-delete` protections were never checked. It now lists with `--method GET`, and a branch whose PRs cannot be read is left alone.
+
 ### Fixed (OpenAPI groups — `bugfix/149-openapi-groups`, #149)
 - Swagger UI now has groups for `codebase` (code copilot and GitHub), `gateway` (Jira integrations), `overview` and `search`; before, only workspace, discovery, iam and billing were documented, so those endpoints were missing from `/swagger-ui.html` and `/api-docs/*`.