diff --git a/modules/openstack_project/files/gerrit/acls/openstack-dev/sandbox.config b/modules/openstack_project/files/gerrit/acls/openstack-dev/sandbox.config
index 52875c86c6..b303f3e262 100644
--- a/modules/openstack_project/files/gerrit/acls/openstack-dev/sandbox.config
+++ b/modules/openstack_project/files/gerrit/acls/openstack-dev/sandbox.config
@@ -6,6 +6,8 @@
         label-Verified = -1..+1 group Third-Party CI
         label-Code-Review = -2..+2 group Registered Users
         label-Workflow = -1..+1 group Registered Users
+[access "refs/tags/*"]
+        pushSignedTag = group openstack-ci-core
 [receive]
         requireChangeId = true
         requireContributorAgreement = true