diff --git a/project.config b/project.config
index 5948a12..4151924 100644
--- a/project.config
+++ b/project.config
@@ -5,17 +5,9 @@
 	requireSignedOffBy = false
 	requireChangeId = true
 	createNewChangeForAllNotInTarget = false
-[accounts]
-	sameGroupVisibility = deny group google/google-union:signcla
-[contributor-agreement "Google CLA"]
-	description = Google Contributor License Agreement
-	agreementUrl = static/cla.html
-	accepted = group google/google-union:signcla
 [submit]
 	mergeContent = false
 	action = cherry pick
-[capability]
-	administrateServer = group mdb/boringssl-committers
 [access "refs/*"]
 	read = group Anonymous Users
 	read = group luci-config-service-account
@@ -44,6 +36,7 @@
 	submit = group cria/project-boringssl-committers
 	editTopicName = +force group Project Owners
 	editTopicName = +force group cria/project-boringssl-committers
+	revert = group Registered Users
 [access "refs/meta/config"]
 	exclusiveGroupPermissions = read
 	read = group Project Owners
@@ -80,11 +73,7 @@
 	value = 0 Not Ready
 	value = +1 Dry Run
 	defaultValue = 0
-	# Comment the following line if you want to disallow automatic CQ commits.
-	# Note, that CQ just "clicks" Submit button, so all the usual checks
-	# (such as Code-Review +2) are applied by Gerrit.
 	value = +2 Ready
-
 [access "refs/heads/chromium-stable"]
 	push = +force group mdb/boringssl-committers
 [access "refs/heads/master-with-bazel"]
@@ -95,3 +84,11 @@
 [access "refs/heads/chromium-stable-with-bazel"]
 	push = group Bazel robots
 	push = group mdb/boringssl-committers
+[accounts]
+	sameGroupVisibility = deny group google/google-union:signcla
+[contributor-agreement "Google CLA"]
+	description = Google Contributor License Agreement
+	agreementUrl = static/cla.html
+	accepted = group google/google-union:signcla
+[capability]
+	administrateServer = group mdb/boringssl-committers