diff --git a/gerrit/acls/openstack/keystoneauth.config b/gerrit/acls/openstack/keystoneauth.config
index 504f30263c..0689f0cdc8 100644
--- a/gerrit/acls/openstack/keystoneauth.config
+++ b/gerrit/acls/openstack/keystoneauth.config
@@ -3,6 +3,18 @@ abandon = group keystoneauth-core
 label-Code-Review = -2..+2 group keystoneauth-core
 label-Workflow = -1..+1 group keystoneauth-core
 
+[access "refs/heads/stable/*"]
+abandon = group Change Owner
+abandon = group Project Bootstrappers
+abandon = group keystone-stable-maint
+exclusiveGroupPermissions = abandon label-Code-Review label-Workflow
+label-Code-Review = -2..+2 group Project Bootstrappers
+label-Code-Review = -2..+2 group keystone-stable-maint
+label-Code-Review = -1..+1 group Registered Users
+label-Workflow = -1..+0 group Change Owner
+label-Workflow = -1..+1 group Project Bootstrappers
+label-Workflow = -1..+1 group keystone-stable-maint
+
 [access "refs/tags/*"]
 pushSignedTag = group library-release