diff --git a/modules/openstack_project/files/gerrit/acls/openstack-ci/puppet-vcsrepo.config b/modules/openstack_project/files/gerrit/acls/openstack-ci/puppet-vcsrepo.config
index 6e93ed15a9..54eb974d3a 100644
--- a/modules/openstack_project/files/gerrit/acls/openstack-ci/puppet-vcsrepo.config
+++ b/modules/openstack_project/files/gerrit/acls/openstack-ci/puppet-vcsrepo.config
@@ -6,6 +6,9 @@
         label-Code-Review = -2..+2 group openstack-ci-admins
         label-Verified = -2..+2 group openstack-ci-admins
         submit = group openstack-ci-admins
+[access "refs/tags/*"]
+        create = group openstack-ci-admins
+        pushTag = group openstack-ci-admins
 [project]
         state = active
 [receive]