diff --git a/gerrit/acls/openstack/congress.config b/gerrit/acls/openstack/congress.config
index 5da4624516..05cd79d2df 100644
--- a/gerrit/acls/openstack/congress.config
+++ b/gerrit/acls/openstack/congress.config
@@ -5,6 +5,13 @@ label-Code-Review = -2..+2 group congress-core
 label-Verified = -1..+1 group congress-ci
 label-Workflow = -1..+1 group congress-core
 
+[access "refs/heads/stable/*"]
+abandon = group congress-stable-maint
+exclusiveGroupPermissions = abandon label-Code-Review label-Workflow
+label-Code-Review = -2..+2 group congress-stable-maint
+label-Code-Review = -1..+1 group Registered Users
+label-Workflow = -1..+1 group congress-stable-maint
+
 [access "refs/tags/*"]
 pushSignedTag = group congress-release