diff --git a/.github/workflows/create-hotfix-pr.yml b/.github/workflows/create-hotfix-pr.yml
index 06d261ffb..875cdba09 100644
--- a/.github/workflows/create-hotfix-pr.yml
+++ b/.github/workflows/create-hotfix-pr.yml
@@ -19,6 +19,11 @@ jobs:
     env:
       BOT_NAME: "flow360-auto-hotfix-bot" # Name for the git committer
       BOT_EMAIL: "flow360-auto-hotfix-bot@users.noreply.github.com" # Email for the git committer
+      # Auto-hotfix is capped at this release-candidate version. Branches above it
+      # (e.g. 25.10, 25.11, 26.x) and main are intentionally NOT targeted.
+      # Bump this when a newer line should start receiving auto-hotfixes.
+      # Format: normalized YY.MM with zero-padded minor (25.9 -> "25.09").
+      MAX_HOTFIX_VERSION: "25.09"
 
     steps:
 
@@ -49,7 +54,7 @@ jobs:
           PR_BASE_BRANCH="${{ steps.get_commit.outputs.base_branch }}"
           echo "PR was merged into: $PR_BASE_BRANCH"
 
-          TARGET_BRANCHES=("main") # Always target main for hotfix
+          TARGET_BRANCHES=() # main is intentionally excluded; only release-candidate branches up to MAX_HOTFIX_VERSION are targeted
 
           # Get all remote 'release-candidate' branches with version pattern as YY.I or YY.II
           ALL_RELEASE_CANDIDATE_BRANCHES=$(git branch -r | grep 'origin/release-candidate/' | sed 's/.*origin\///' | grep -E '^release-candidate/[0-9]{2}\.[0-9]{1,2}$' | sort -V)
@@ -75,10 +80,12 @@ jobs:
                   BRANCH_VERSION=$(echo "$BRANCH_VERSION" | awk '{printf "%s%02d", substr($1,1,3), substr($1,4)}')
                 fi
 
-                # Compare versions
-                if (( $(echo "$BRANCH_VERSION > $PR_BASE_VERSION" | bc -l) )); then
+                # Target branches higher than the PR base but not above the auto-hotfix cap.
+                if (( $(echo "$BRANCH_VERSION > $PR_BASE_VERSION" | bc -l) )) && (( $(echo "$BRANCH_VERSION <= $MAX_HOTFIX_VERSION" | bc -l) )); then
                   TARGET_BRANCHES+=("$branch")
-                  echo "Adding $branch (version $BRANCH_VERSION) as it's higher than $PR_BASE_BRANCH (version $PR_BASE_VERSION)"
+                  echo "Adding $branch (version $BRANCH_VERSION): higher than $PR_BASE_BRANCH ($PR_BASE_VERSION) and within cap $MAX_HOTFIX_VERSION"
+                elif (( $(echo "$BRANCH_VERSION > $MAX_HOTFIX_VERSION" | bc -l) )); then
+                  echo "Skipping $branch (version $BRANCH_VERSION): above auto-hotfix cap $MAX_HOTFIX_VERSION"
                 fi
               fi
             done