diff --git a/project.config b/project.config
index a8c8505..ef0b60e 100644
--- a/project.config
+++ b/project.config
@@ -8,11 +8,6 @@
 [submit]
 	mergeContent = true
 	action = cherry pick
-[capability]
-	administrateServer = group Admins
-	administrateServer = group mdb/cuelang-repo
-	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	viewAllAccounts = group mdb/copybara-git-readers
 [access "refs/*"]
 	read = group Anonymous Users
 	read = group mdb/cuelang-repo
@@ -58,6 +53,7 @@
 	label-Code-Review = -2..+2 group Project Owners
 	label-Code-Review = -2..+2 group mdb/cuelang-repo
 	push = group Admins
+	push = group Approvers
 	push = group Project Owners
 	push = group mdb/cuelang-repo
 	read = group Admins
@@ -90,3 +86,8 @@
 	value = 0 No score
 	value = +1 Looks good to me, but someone else must approve
 	value = +2 Looks good to me, approved
+[capability]
+	administrateServer = group Admins
+	administrateServer = group mdb/cuelang-repo
+	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
+	viewAllAccounts = group mdb/copybara-git-readers