diff --git a/pantheon.upstream.yml b/pantheon.upstream.yml
index 7c2d1219..e814dcbf 100644
--- a/pantheon.upstream.yml
+++ b/pantheon.upstream.yml
@@ -1,8 +1,12 @@
+# IMPORTANT NOTE:
+# Do not edit this file unless you are doing so in your custom upstream repository.
+# Override the defaults specified here in a site-specific `pantheon.yml` file.
+# For more information see: https://pantheon.io/docs/pantheon-upstream-yml
 api_version: 1
 web_docroot: true
 # See https://pantheon.io/docs/pantheon-yml/#enforce-https--hsts for valid values.
 enforce_https: transitional
-php_version: 8.1
+php_version: 8.2
 database:
   version: 10.4
 build_step: true
diff --git a/pantheon.yml b/pantheon.yml
new file mode 100644
index 00000000..0147f8c9
--- /dev/null
+++ b/pantheon.yml
@@ -0,0 +1,30 @@
+# This has local overrides of the upstream defaults found in pantheon.upstream.yml. Changes should be made here, and not
+# to pantheon.upstream.yml.
+api_version: 1
+
+web_docroot: true
+
+# See https://pantheon.io/docs/pantheon-yml/#enforce-https--hsts for valid values.
+enforce_https: transitional
+
+php_version: 8.2
+
+# See https://pantheon.io/docs/pantheon-yml#specify-a-version-of-mariadb
+database:
+  version: 10.4
+
+build_step: true
+
+filemount: /app/uploads
+
+# See https://pantheon.io/docs/pantheon-yml#protected-web-paths for usage.
+protected_web_paths:
+  - /app/uploads/private/
+  - /private/
+  - /xmlrpc.php
+
+# By default, any 'protected_web_paths' added to the pantheon.yml file
+# are combined with the paths from the pantheon.upstream.yml file. If
+# 'protected_web_paths_override' is set to true, then the upstream paths
+# are disabled.
+protected_web_paths_override: false