diff --git a/modules/openstack_project/files/gerrit/acls/openstack-ci/jenkins-job-builder.config b/modules/openstack_project/files/gerrit/acls/openstack-ci/jenkins-job-builder.config
index e41e3402ce..eca426feb8 100644
--- a/modules/openstack_project/files/gerrit/acls/openstack-ci/jenkins-job-builder.config
+++ b/modules/openstack_project/files/gerrit/acls/openstack-ci/jenkins-job-builder.config
@@ -1,6 +1,9 @@
 [access "refs/heads/*"]
-        label-Approved = +0..+1 group openstack-ci-admins
-        label-Code-Review = -2..+2 group openstack-ci-admins
+        label-Approved = +0..+1 group openstack-ci-core
+        label-Code-Review = -2..+2 group openstack-ci-core
+[access "refs/tags/*"]
+        create = group openstack-ci-core
+        pushTag = group openstack-ci-core
 [project]
         state = active
 [receive]