diff --git a/groups b/groups
index 1817bc7..3c7a332 100644
--- a/groups
+++ b/groups
@@ -11,10 +11,10 @@
 e8ca8f450a1f9ddc20e55bc6c01a83137587fd7b                      	luci-config-service-account
 ff4af7bc5c74afa6adefe7f75f2d0a85b68db16c                      	gerrit-submit-requirements-admins
 global:Anonymous-Users                                        	Anonymous Users
+global:Change-Owner                                           	Change Owner
 global:Project-Owners                                         	Project Owners
 global:Registered-Users                                       	Registered Users
 google:AI2Pq9r_ksT_hfUOny8swsG8krQwPL5eOM0hGHf4QWGOPdy9igqsdhs	google/google-union:signcla
 mdb:boringssl-commiters                                       	mdb/boringssl-commiters
 mdb:boringssl-committers                                      	mdb/boringssl-committers
 mdb:chrome-git-admins                                         	mdb/chrome-git-admins
-global:Change-Owner                                           	Change Owner
diff --git a/project.config b/project.config
index 1736ca2..3ec5872 100644
--- a/project.config
+++ b/project.config
@@ -118,6 +118,9 @@
 [access "refs/heads/main-with-bazel"]
 	push = group Bazel robots
 	push = group bot-commit-grandfathered-bots
+[access "refs/for/refs/meta/config"]
+	push = group gerrit-submit-requirements-admins
+	read = group gerrit-submit-requirements-admins
 [accounts]
 	sameGroupVisibility = deny group google/google-union:signcla
 [contributor-agreement "Google CLA"]
@@ -128,13 +131,11 @@
 [capability]
 	administrateServer = group mdb/boringssl-committers
 	administrateServer = group mdb/chrome-git-admins
-[access "refs/for/refs/meta/config"]
-	push = group gerrit-submit-requirements-admins
-	read = group gerrit-submit-requirements-admins
+	viewAllAccounts = group boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com
+[plugin "jwtservice"]
+	audience = https://api.cr.dev
 [submit-requirement "Code-Review"]
 	description = At least one maximum vote for label 'Code-Review' is required
 	submittableIf = label:Code-Review=MAX,user=non_uploader AND -label:Code-Review=MIN
 	overrideIf = label:Bot-Commit=+1 AND -label:Code-Review=MIN
 	canOverrideInChildProjects = true
-[plugin "jwtservice"]
-  audience = https://api.cr.dev