diff --git a/gerrit/acls/openstack/watcher-dashboard.config b/gerrit/acls/openstack/watcher-dashboard.config
index 53f1f937eb..ec9b00b85b 100644
--- a/gerrit/acls/openstack/watcher-dashboard.config
+++ b/gerrit/acls/openstack/watcher-dashboard.config
@@ -6,6 +6,18 @@
 	label-Code-Review = -2..+2 group watcher-dashboard-core
 	label-Workflow = -1..+1 group watcher-dashboard-core
 
+[access "refs/heads/stable/*"]
+	abandon = group Change Owner
+	abandon = group Project Bootstrappers
+	abandon = group watcher-dashboard-release
+	exclusiveGroupPermissions = abandon label-Code-Review label-Workflow
+	label-Code-Review = -2..+2 group Project Bootstrappers
+	label-Code-Review = -2..+2 group watcher-dashboard-release
+	label-Code-Review = -1..+1 group Registered Users
+	label-Workflow = -1..+0 group Change Owner
+	label-Workflow = -1..+1 group Project Bootstrappers
+	label-Workflow = -1..+1 group watcher-dashboard-release
+
 [receive]
 	requireChangeId = true
 	requireContributorAgreement = true
diff --git a/gerrit/acls/openstack/watcher.config b/gerrit/acls/openstack/watcher.config
index a4c4c09390..a16da2a600 100644
--- a/gerrit/acls/openstack/watcher.config
+++ b/gerrit/acls/openstack/watcher.config
@@ -6,6 +6,18 @@
 	label-Code-Review = -2..+2 group watcher-core
 	label-Workflow = -1..+1 group watcher-core
 
+[access "refs/heads/stable/*"]
+	abandon = group Change Owner
+	abandon = group Project Bootstrappers
+	abandon = group watcher-release
+	exclusiveGroupPermissions = abandon label-Code-Review label-Workflow
+	label-Code-Review = -2..+2 group Project Bootstrappers
+	label-Code-Review = -2..+2 group watcher-release
+	label-Code-Review = -1..+1 group Registered Users
+	label-Workflow = -1..+0 group Change Owner
+	label-Workflow = -1..+1 group Project Bootstrappers
+	label-Workflow = -1..+1 group watcher-release
+
 [receive]
 	requireChangeId = true
 	requireContributorAgreement = true