diff --git a/groups b/groups
index de06685..8c377e9 100644
--- a/groups
+++ b/groups
@@ -9,6 +9,7 @@
 c858fde81af761c6cd3b79c6eb7922a5d57b609c                      	boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com
 cria:project-boringssl-committers                             	cria/project-boringssl-committers
 e8ca8f450a1f9ddc20e55bc6c01a83137587fd7b                      	luci-config-service-account
+ff4af7bc5c74afa6adefe7f75f2d0a85b68db16c                      	gerrit-submit-requirements-admins
 global:Anonymous-Users                                        	Anonymous Users
 global:Project-Owners                                         	Project Owners
 global:Registered-Users                                       	Registered Users
diff --git a/project.config b/project.config
index 65677b3..2dd4674 100644
--- a/project.config
+++ b/project.config
@@ -44,6 +44,7 @@
 [access "refs/meta/config"]
 	exclusiveGroupPermissions = read
 	read = group Project Owners
+	read = group gerrit-submit-requirements-admins
 	read = group mdb/boringssl-committers
 	read = group mdb/chrome-git-admins
 	push = group Project Owners
@@ -118,11 +119,14 @@
 [contributor-agreement "Google CLA"]
 	description = Google Contributor License Agreement
 	agreementUrl = static/cla.html
-	accepted = group google/google-union:signcla
 	accepted = group bot-commit-grandfathered-bots
+	accepted = group google/google-union:signcla
 [capability]
 	administrateServer = group mdb/boringssl-committers
 	administrateServer = group mdb/chrome-git-admins
+[access "refs/for/refs/meta/config"]
+	push = group gerrit-submit-requirements-admins
+	read = group gerrit-submit-requirements-admins
 [plugin "uploadvalidator"]
 	blockedContentTypeWhitelist = false
 	blockedKeywordPattern = testfishiamfake