diff --git a/modules/openstack_project/files/gerrit/acls/openstack-infra/puppet-yum.config b/modules/openstack_project/files/gerrit/acls/openstack-infra/puppet-yum.config
index 7cce171c8d..27dc079338 100644
--- a/modules/openstack_project/files/gerrit/acls/openstack-infra/puppet-yum.config
+++ b/modules/openstack_project/files/gerrit/acls/openstack-infra/puppet-yum.config
@@ -3,6 +3,9 @@ abandon = group infra-core
 label-Code-Review = -2..+2 group infra-core
 label-Workflow = -1..+1 group infra-core
 
+[access "refs/tags/*"]
+pushSignedTag = group infra-core
+
 [receive]
 requireChangeId = true
 requireContributorAgreement = true