diff --git a/.github/workflows/updater.yml b/.github/workflows/updater.yml
index 03b5202..3be0889 100644
--- a/.github/workflows/updater.yml
+++ b/.github/workflows/updater.yml
@@ -136,9 +136,17 @@ jobs:
           }
           "baseBranch=$mainBranch" | Tee-Object $env:GITHUB_OUTPUT -Append
           "prBranch=$prBranch" | Tee-Object $env:GITHUB_OUTPUT -Append
+          $nonBotCommits = ${{ runner.temp }}/ghwf/updater/scripts/nonbot-commits.ps1 `
+            -RepoUrl "$(git config --get remote.origin.url)" -PrBranch $prBranch -MainBranch $mainBranch
+          $changed = $nonBotCommits.Length -gt 0 ? 'true' : 'false'
+          "changed=$changed" | Tee-Object $env:GITHUB_OUTPUT -Append
+          if ("$changed" -eq "true")
+          {
+              Write-Output "::warning::Target branch '$prBranch' has been changed manually - skipping updater to avoid overwriting these changes."
+          }
 
       - name: Fetch an existing PR
-        if: steps.target.outputs.latestTag != steps.target.outputs.originalTag
+        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
         uses: octokit/request-action@89a1754fe82ca777b044ca8e79e9881a42f15a93 # v2.1.7
         id: existing-pr-request
         with:
@@ -149,7 +157,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Parse the existing PR URL
-        if: steps.target.outputs.latestTag != steps.target.outputs.originalTag
+        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
         id: existing-pr
         run: |
           $data = @'
@@ -173,10 +181,10 @@ jobs:
           }
 
       - run: git --no-pager diff
-        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.existing-pr.outputs.url == '') }}
+        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.existing-pr.outputs.url == '') && ( steps.root.outputs.changed == 'false') }}
 
       - name: Get target changelog
-        if: steps.target.outputs.latestTag != steps.target.outputs.originalTag
+        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
         run: |
           $changelog = ${{ runner.temp }}/ghwf/updater/scripts/get-changelog.ps1 `
             -RepoUrl '${{ steps.target.outputs.url }}' `
@@ -186,7 +194,7 @@ jobs:
 
       # First we create a PR only if it doesn't exist. We will later overwrite the content with the same action.
       - name: Create a PR
-        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.existing-pr.outputs.url == '') }}
+        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.existing-pr.outputs.url == '') && ( steps.root.outputs.changed == 'false') }}
         uses: peter-evans/create-pull-request@b4d51739f96fca8047ad065eccef63442d8e99f7 # pin#v4
         id: create-pr
         with:
@@ -204,7 +212,7 @@ jobs:
           # draft: true
 
       - name: Verify we have a PR
-        if: steps.target.outputs.latestTag != steps.target.outputs.originalTag
+        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
         id: pr
         run: |
           if ('${{ steps.create-pr.outputs.pull-request-url }}' -ne '')
@@ -223,17 +231,17 @@ jobs:
       # If we had to create a new PR, we must do a clean checkout & update the submodule again.
       # If we didn't do this, the new PR would only have a changelog...
       - name: 'After new PR: restore repo'
-        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.existing-pr.outputs.url == '') }}
+        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.existing-pr.outputs.url == '') && ( steps.root.outputs.changed == 'false') }}
         uses: actions/checkout@v3
         with:
           ssh-key: ${{ secrets.api-token }}
 
       - name: 'After new PR: redo the update'
-        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.existing-pr.outputs.url == '') }}
+        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.existing-pr.outputs.url == '') && ( steps.root.outputs.changed == 'false') }}
         run: ${{ runner.temp }}/ghwf/updater/scripts/update-dependency.ps1 -Path '${{ inputs.path }}' -Tag '${{ steps.target.outputs.latestTag }}'
 
       - name: Update Changelog
-        if: ${{ inputs.changelog-entry && ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) }}
+        if: ${{ inputs.changelog-entry && ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
         run: |
           ${{ runner.temp }}/ghwf/updater/scripts/update-changelog.ps1 `
             -Name '${{ inputs.name }}' `
@@ -245,11 +253,11 @@ jobs:
             -Section '${{ inputs.changelog-section }}'
 
       - run: git --no-pager diff
-        if: steps.target.outputs.latestTag != steps.target.outputs.originalTag
+        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
 
       # Now make the PR in its final state. This way we only have one commit and no updates if there are no changes between runs.
       - name: Update the PR
-        if: steps.target.outputs.latestTag != steps.target.outputs.originalTag
+        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
         uses: peter-evans/create-pull-request@b4d51739f96fca8047ad065eccef63442d8e99f7
         with:
           base: ${{ steps.root.outputs.baseBranch }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 56dc235..007c42b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,14 +2,15 @@
 
 ## Unreleased
 
-### Fixes
-
-- Updater - update deprecated actions ([#48](https://github.com/getsentry/github-workflows/pull/48))
-
 ### Features
 
+- Updater - don't update existing branches if there are manually added commits ([#50](https://github.com/getsentry/github-workflows/pull/50))
 - Danger - ignore "deps" and "test" PR flavors in changelog checks ([#49](https://github.com/getsentry/github-workflows/pull/49))
 
+### Fixes
+
+- Updater - update deprecated actions ([#48](https://github.com/getsentry/github-workflows/pull/48))
+
 ## 2.4.0
 
 ### Features
diff --git a/updater/scripts/get-changelog.ps1 b/updater/scripts/get-changelog.ps1
index 1a2253a..8be945f 100644
--- a/updater/scripts/get-changelog.ps1
+++ b/updater/scripts/get-changelog.ps1
@@ -14,6 +14,7 @@ if (-not ($RepoUrl -match "^$prefix"))
 }
 
 $tmpDir = Join-Path ([System.IO.Path]::GetTempPath()) ([System.Guid]::NewGuid())
+New-Item -ItemType Directory $tmpDir | Out-Null
 
 try
 {
diff --git a/updater/scripts/nonbot-commits.ps1 b/updater/scripts/nonbot-commits.ps1
new file mode 100644
index 0000000..7d69996
--- /dev/null
+++ b/updater/scripts/nonbot-commits.ps1
@@ -0,0 +1,39 @@
+# Finds commits in a branch that weren't made by <noreply@github.com>
+param(
+    [Parameter(Mandatory = $true)][string] $RepoUrl,
+    [Parameter(Mandatory = $true)][string] $PrBranch,
+    [Parameter(Mandatory = $true)][string] $MainBranch
+)
+
+Set-StrictMode -Version latest
+$ErrorActionPreference = "Stop"
+
+$bot = "<noreply@github.com>"
+$tmpDir = Join-Path ([System.IO.Path]::GetTempPath()) ([System.Guid]::NewGuid())
+
+New-Item -ItemType Directory $tmpDir | Out-Null
+Push-Location $tmpDir
+try
+{
+    git init | Out-Null
+    git remote add origin $RepoUrl | Out-Host
+    git fetch --depth 1 origin $MainBranch | Out-Host
+    git fetch --depth 1 origin $PrBranch | Out-Host
+
+    #Note: we're intentionally ignoring exit codes from git, to make sure we don't fail if the branch doesn't exist.
+    $allCommits = @(git log --oneline "origin/$MainBranch..origin/$PrBranch")
+    $botCommits = @(git log --oneline "origin/$MainBranch..origin/$PrBranch" --author=$bot)
+    $nonbotCommits = @(Compare-Object -ReferenceObject $allCommits -DifferenceObject $botCommits -PassThru)
+
+    if ($nonbotCommits.Length -gt 0)
+    {
+        Write-Warning "There are commits made by others than $bot"
+    }
+    $nonbotCommits
+}
+finally
+{
+    Pop-Location
+    Write-Host "Removing $tmpDir"
+    Remove-Item -Recurse -Force -ErrorAction Continue -Path $tmpDir
+}
diff --git a/updater/tests/common/test-utils.ps1 b/updater/tests/common/test-utils.ps1
index 785fe00..a9bf444 100644
--- a/updater/tests/common/test-utils.ps1
+++ b/updater/tests/common/test-utils.ps1
@@ -1,3 +1,6 @@
+Set-StrictMode -Version latest
+$ErrorActionPreference = "Stop"
+
 function RunTest ([string] $name, [ScriptBlock] $code, [string] $skipReason = "")
 {
     if ($skipReason -ne "")
diff --git a/updater/tests/get-changelog.ps1 b/updater/tests/get-changelog.ps1
index efd2607..72e710e 100644
--- a/updater/tests/get-changelog.ps1
+++ b/updater/tests/get-changelog.ps1
@@ -1,5 +1,3 @@
-Set-StrictMode -Version latest
-
 . "$PSScriptRoot/common/test-utils.ps1"
 
 RunTest "get-changelog with existing versions" {
diff --git a/updater/tests/nonbot-commits.ps1 b/updater/tests/nonbot-commits.ps1
new file mode 100644
index 0000000..9d616fe
--- /dev/null
+++ b/updater/tests/nonbot-commits.ps1
@@ -0,0 +1,29 @@
+Set-StrictMode -Version latest
+
+. "$PSScriptRoot/common/test-utils.ps1"
+
+function NonBotCommits([Parameter(Mandatory = $true)][string] $branch)
+{
+    $result = & "$PSScriptRoot/../scripts/nonbot-commits.ps1" `
+        -RepoUrl 'https://github.com/getsentry/github-workflows' -MainBranch "main" -PrBranch $branch
+    if (-not $?)
+    {
+        throw $result
+    }
+    $result
+}
+
+RunTest "empty-if-all-commits-by-bot" {
+    $commits = NonBotCommits 'deps/updater/tests/sentry-cli.properties'
+    AssertEqual "$commits" ""
+}
+
+RunTest "empty-if-branch-doesnt-exist" {
+    $commits = NonBotCommits 'non-existent-branch'
+    AssertEqual "$commits" ""
+}
+
+RunTest "non-empty-if-changed" {
+    $commits = NonBotCommits 'test/nonbot-commits'
+    AssertEqual "$commits" "6133a25 Update README.md"
+}
diff --git a/updater/tests/sort-versions.ps1 b/updater/tests/sort-versions.ps1
index e71334e..f4cc31e 100644
--- a/updater/tests/sort-versions.ps1
+++ b/updater/tests/sort-versions.ps1
@@ -1,5 +1,3 @@
-Set-StrictMode -Version latest
-
 . "$PSScriptRoot/common/test-utils.ps1"
 
 function SortVersions([Parameter(Mandatory = $true)][string[]] $List)
diff --git a/updater/tests/update-changelog.ps1 b/updater/tests/update-changelog.ps1
index 507e478..90d4896 100644
--- a/updater/tests/update-changelog.ps1
+++ b/updater/tests/update-changelog.ps1
@@ -1,5 +1,3 @@
-Set-StrictMode -Version latest
-
 . "$PSScriptRoot/common/test-utils.ps1"
 
 $testCases = Get-ChildItem "$PSScriptRoot/testdata/changelog/"
diff --git a/updater/tests/update-dependency.ps1 b/updater/tests/update-dependency.ps1
index b5607d6..9a6eb1f 100644
--- a/updater/tests/update-dependency.ps1
+++ b/updater/tests/update-dependency.ps1
@@ -1,5 +1,3 @@
-Set-StrictMode -Version latest
-
 . "$PSScriptRoot/common/test-utils.ps1"
 
 function UpdateDependency([Parameter(Mandatory = $true)][string] $path, [string] $pattern = $null)
@@ -63,7 +61,7 @@ RunTest "writes to env:GITHUB_OUTPUT" {
     $repo = 'https://github.com/getsentry/sentry-cli'
     @("repo=$repo", "version=0") | Out-File $testFile
     $outFile = "$testDir/outfile"
-    New-Item $outFile -ItemType File
+    New-Item $outFile -ItemType File | Out-Null
     try
     {
         $env:GITHUB_OUTPUT = $outFile
@@ -76,8 +74,8 @@ RunTest "writes to env:GITHUB_OUTPUT" {
     finally
     {
         # Delete the file and unser the env variable
-        Remove-Item $outFile
-        Remove-Item env:GITHUB_OUTPUT
+        Remove-Item $outFile | Out-Null
+        Remove-Item env:GITHUB_OUTPUT | Out-Null
     }
 }
 
@@ -117,6 +115,7 @@ RunTest "bash-script" {
     $testScript = "$testDir/test.sh"
     @'
 #!/usr/bin/env bash
+set -euo pipefail
 cd $(dirname "$0")
 case $1 in
 get-version)
@@ -176,6 +175,7 @@ RunTest "bash-script fails in get-repo" {
     $testScript = "$testDir/test.sh"
     @'
 #!/usr/bin/env bash
+set -euo pipefail
 case $1 in
 get-version)
     ;;
@@ -210,6 +210,7 @@ RunTest "bash-script fails in set-version" {
     $testScript = "$testDir/test.sh"
     @'
 #!/usr/bin/env bash
+set -euo pipefail
 cd $(dirname "$0")
 case $1 in
 get-version)