diff --git a/manifests/site.pp b/manifests/site.pp
index 14a29addff..174d318200 100644
--- a/manifests/site.pp
+++ b/manifests/site.pp
@@ -528,6 +528,8 @@ node /^git\d+\.openstack\.org$/ {
 # A machine to drive AFS mirror updates.
 # Node-OS: trusty
 node 'mirror-update.openstack.org' {
+  $group = "afsadmin"
+
   class { 'openstack_project::mirror_update':
     bandersnatch_keytab => hiera('bandersnatch_keytab'),
     admin_keytab        => hiera('afsadmin_keytab'),
@@ -881,6 +883,8 @@ node 'proposal.slave.openstack.org' {
 
 # Node-OS: trusty
 node 'release.slave.openstack.org' {
+  $group = "afsadmin"
+
   include openstack_project
   class { 'openstack_project::release_slave':
     pypi_username          => 'openstackci',
diff --git a/modules/openstack_project/files/puppetmaster/groups.txt b/modules/openstack_project/files/puppetmaster/groups.txt
index 25c011eaac..74ae5a9d1e 100644
--- a/modules/openstack_project/files/puppetmaster/groups.txt
+++ b/modules/openstack_project/files/puppetmaster/groups.txt
@@ -10,4 +10,5 @@ ci-backup ci-backup-*.openstack.org
 afsdb afsdb*.openstack.org
 afs afs*.*.openstack.org
 wheel-mirror *wheel-mirror-*.openstack.org
+afs-admin mirror-update.openstack.org:release.slave.openstack.org
 disabled ci-backup-rs-ord.openstack.org:jenkins-dev.openstack.org:ask-staging.openstack.org