diff --git a/project.config b/project.config
index beb4ff382..49f59f1b2 100644
--- a/project.config
+++ b/project.config
@@ -5,8 +5,9 @@
 [submit]
 	action = cherry pick
 [access "refs/tags/*"]
-	push = +force group flashrom developers
-	exclusiveGroupPermissions = push
+	exclusiveGroupPermissions = createTag createSignedTag
+	createTag = group flashrom developers
+	createSignedTag = group flashrom developers
 
 [label "Code-Review"]
 	function = MaxWithBlock