diff --git a/gerrit/acls/openstack/bifrost.config b/gerrit/acls/openstack/bifrost.config
index 47eb665e87..a44e333c1a 100644
--- a/gerrit/acls/openstack/bifrost.config
+++ b/gerrit/acls/openstack/bifrost.config
@@ -45,6 +45,19 @@
 	label-Workflow = -1..+1 group ironic-stable-maint
 	label-Workflow = -1..+1 group stable-maint-core
 
+[access "refs/heads/unmaintained/*"]
+	abandon = group Change Owner
+	abandon = group Project Bootstrappers
+	abandon = group Release Managers
+	abandon = group ironic-unmaintained-core
+	exclusiveGroupPermissions = abandon label-Code-Review label-Workflow
+	label-Code-Review = -2..+2 group Project Bootstrappers
+	label-Code-Review = -2..+2 group ironic-unmaintained-core
+	label-Code-Review = -1..+1 group Registered Users
+	label-Workflow = -1..+0 group Change Owner
+	label-Workflow = -1..+1 group Project Bootstrappers
+	label-Workflow = -1..+1 group ironic-unmaintained-core
+
 [access "refs/tags/*"]
 	createSignedTag = group ironic-release