diff --git a/firestore.indexes.json b/firestore.indexes.json
index cdf966cf6..427795d41 100644
--- a/firestore.indexes.json
+++ b/firestore.indexes.json
@@ -18,6 +18,28 @@
         }
       ]
     },
+    {
+      "collectionGroup": "archivedTestimony",
+      "queryScope": "COLLECTION",
+      "fields": [
+        {
+          "fieldPath": "billId",
+          "order": "ASCENDING"
+        },
+        {
+          "fieldPath": "court",
+          "order": "ASCENDING"
+        },
+        {
+          "fieldPath": "ballotQuestionId",
+          "order": "ASCENDING"
+        },
+        {
+          "fieldPath": "version",
+          "order": "DESCENDING"
+        }
+      ]
+    },
     {
       "collectionGroup": "bills",
       "queryScope": "COLLECTION",
@@ -727,6 +749,31 @@
           "order": "ASCENDING"
         }
       ]
+    },
+    {
+      "collectionGroup": "ballotQuestions",
+      "queryScope": "COLLECTION",
+      "fields": [
+        { "fieldPath": "electionYear", "order": "ASCENDING" },
+        { "fieldPath": "ballotStatus", "order": "ASCENDING" }
+      ]
+    },
+    {
+      "collectionGroup": "publishedTestimony",
+      "queryScope": "COLLECTION_GROUP",
+      "fields": [
+        { "fieldPath": "ballotQuestionId", "order": "ASCENDING" },
+        { "fieldPath": "publishedAt", "order": "DESCENDING" }
+      ]
+    },
+    {
+      "collectionGroup": "publishedTestimony",
+      "queryScope": "COLLECTION",
+      "fields": [
+        { "fieldPath": "billId", "order": "ASCENDING" },
+        { "fieldPath": "court", "order": "ASCENDING" },
+        { "fieldPath": "ballotQuestionId", "order": "ASCENDING" }
+      ]
     }
   ],
   "fieldOverrides": [
@@ -865,6 +912,17 @@
           "queryScope": "COLLECTION_GROUP"
         }
       ]
+    },
+    {
+      "collectionGroup": "publishedTestimony",
+      "fieldPath": "ballotQuestionId",
+      "ttl": false,
+      "indexes": [
+        {
+          "order": "ASCENDING",
+          "queryScope": "COLLECTION_GROUP"
+        }
+      ]
     }
   ]
 }
diff --git a/firestore.rules b/firestore.rules
index 978809c0f..a95586279 100644
--- a/firestore.rules
+++ b/firestore.rules
@@ -99,6 +99,10 @@ service cloud.firestore {
         allow read, write: if request.auth.token.get("role", "user") == "admin"
       }
     }
+    match /ballotQuestions/{id} {
+      allow read: if true;
+      allow write: if false;
+    }
     match /transcriptions/{tid} {
       // public, read-only
       allow read: if true