diff --git a/gerrit/acls/openstack/aodh.config b/gerrit/acls/openstack/aodh.config
index 5290285b67..63f8c19d26 100644
--- a/gerrit/acls/openstack/aodh.config
+++ b/gerrit/acls/openstack/aodh.config
@@ -1,11 +1,14 @@
 [access "refs/heads/*"]
 abandon = group aodh-core
-create = group aodh-release
 label-Code-Review = -2..+2 group aodh-core
 label-Workflow = -1..+1 group aodh-core
 
-[access "refs/tags/*"]
-pushSignedTag = group aodh-release
+[access "refs/heads/stable/*"]
+abandon = group aodh-stable-maint
+exclusiveGroupPermissions = abandon label-Code-Review label-Workflow
+label-Code-Review = -2..+2 group aodh-stable-maint
+label-Code-Review = -1..+1 group Registered Users
+label-Workflow = -1..+1 group aodh-stable-maint
 
 [receive]
 requireChangeId = true