diff --git a/groups b/groups
index 332dfd5..ed0a526 100644
--- a/groups
+++ b/groups
@@ -5,5 +5,6 @@
 global:Registered-Users 	Registered Users
 ldap:rch                	ldap/rch
 mdb:copybara-git-readers	mdb/copybara-git-readers
+mdb:copybara-git-writers	mdb/copybara-git-writers
 mdb:quiche-dev          	mdb/quiche-dev
 mdb:quiche-dev-git-admin	mdb/quiche-dev-git-admin
diff --git a/project.config b/project.config
index 5761a4e..d8035b0 100644
--- a/project.config
+++ b/project.config
@@ -7,10 +7,6 @@
 	enableSignedPush = false
 [submit]
 	mergeContent = true
-[capability]
-	administrateServer = group mdb/quiche-dev-git-admin
-	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	viewAllAccounts = group mdb/copybara-git-readers
 [access "refs/*"]
 	read = group Anonymous Users
 	read = group mdb/quiche-dev-git-admin
@@ -21,13 +17,16 @@
 	pushMerge = group Registered Users
 [access "refs/heads/*"]
 	create = group Project Owners
+	create = group mdb/copybara-git-writers
 	create = group mdb/quiche-dev
 	create = group mdb/quiche-dev-git-admin
 	editTopicName = +force group Project Owners
 	editTopicName = group mdb/quiche-dev
 	editTopicName = +force group mdb/quiche-dev-git-admin
 	forgeAuthor = group Registered Users
+	forgeAuthor = group mdb/copybara-git-writers
 	forgeCommitter = group Project Owners
+	forgeCommitter = group mdb/copybara-git-writers
 	forgeCommitter = group mdb/quiche-dev-git-admin
 	label-Code-Review = -2..+2 group Project Owners
 	label-Code-Review = -2..+2 group ldap/rch
@@ -35,6 +34,7 @@
 	label-Code-Review = -2..+2 group mdb/quiche-dev-git-admin
 	label-Code-Review = -1..+1 group Registered Users
 	push = group Project Owners
+	push = group mdb/copybara-git-writers
 	push = group mdb/quiche-dev-git-admin
 	submit = group Project Owners
 	submit = group mdb/quiche-dev
@@ -79,3 +79,7 @@
 	delete = group mdb/quiche-dev
 	push = group mdb/quiche-dev
 	pushMerge = group mdb/quiche-dev
+[capability]
+	administrateServer = group mdb/quiche-dev-git-admin
+	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
+	viewAllAccounts = group mdb/copybara-git-readers