diff --git a/gerrit/acls/openstack/retired.config b/gerrit/acls/openstack/retired.config
index 9e7a0f50b2..2a5c607a68 100644
--- a/gerrit/acls/openstack/retired.config
+++ b/gerrit/acls/openstack/retired.config
@@ -1,2 +1,16 @@
-[project]
-state = read only
+[access "refs/for/refs/heads/*"]
+exclusiveGroupPermissions = push
+push = group tech-committee
+submit = group tech-committee
+
+[access "refs/heads/*"]
+label-Code-Review = -2..+2 group tech-committee
+label-Verified = -2..+2 group tech-committee
+label-Workflow = -1..+1 group tech-committee
+
+[receive]
+requireChangeId = true
+requireContributorAgreement = true
+
+[submit]
+mergeContent = true
diff --git a/tools/normalize_acl.py b/tools/normalize_acl.py
index cd71d31fb3..d40031d819 100755
--- a/tools/normalize_acl.py
+++ b/tools/normalize_acl.py
@@ -82,6 +82,7 @@ valid_keys = {'abandon',
               'requireChangeId',
               'requireContributorAgreement',
               'state',
+              'submit',
               'value'}
 
 if '0' in transformations or not transformations: