diff --git a/gerrit/acls/openstack/puppet-ceph.config b/gerrit/acls/openstack/puppet-ceph.config
index 319a3db687..aac01e772c 100644
--- a/gerrit/acls/openstack/puppet-ceph.config
+++ b/gerrit/acls/openstack/puppet-ceph.config
@@ -7,6 +7,12 @@
 	label-Verified = -1..+1 group puppet-ceph-ci
 	label-Workflow = -1..+1 group puppet-ceph-core
 
+[access "refs/heads/stable/*"]
+	delete = group puppet-ceph-release
+
+[access "refs/tags/*"]
+	createSignedTag = group puppet-ceph-release
+
 [receive]
 	requireChangeId = true
 	requireContributorAgreement = false