diff --git a/groups b/groups
index c1016f6..b891d1b 100644
--- a/groups
+++ b/groups
@@ -1,11 +1,12 @@
-# UUID                                  	Group Name
+# UUID                                                        	Group Name
 #
-66326fee1502be50f366279038a41476658a69c1	Administrators
-f7db30a3f0ff326e3c86b9c76703f7a29d69e51c	Googlers
-global:Anonymous-Users                  	Anonymous Users
-global:Project-Owners                   	Project Owners
-global:Registered-Users                 	Registered Users
+66326fee1502be50f366279038a41476658a69c1                      	Administrators
+f7db30a3f0ff326e3c86b9c76703f7a29d69e51c                      	Googlers
+global:Anonymous-Users                                        	Anonymous Users
+global:Project-Owners                                         	Project Owners
+global:Registered-Users                                       	Registered Users
 google:AI2Pq9r_ksT_hfUOny8swsG8krQwPL5eOM0hGHf4QWGOPdy9igqsdhs	google/google-union:signcla
-mdb:pigweed-gob-admin                   	mdb/pigweed-gob-admin
-mdb:pigweed-gob-admin-acl               	mdb/pigweed-gob-admin-acl
-mdb:google-cla-gerrit-robot-accounts    	mdb/google-cla-gerrit-robot-accounts
+mdb:google-cla-gerrit-robot-accounts                          	mdb/google-cla-gerrit-robot-accounts
+mdb:pigweed-gerrit-configplustwo-acl                          	mdb/pigweed-gerrit-configplustwo-acl
+mdb:pigweed-gob-admin                                         	mdb/pigweed-gob-admin
+mdb:pigweed-gob-admin-acl                                     	mdb/pigweed-gob-admin-acl
diff --git a/project.config b/project.config
index 77bd2c0..598a7b1 100644
--- a/project.config
+++ b/project.config
@@ -37,6 +37,7 @@
 	create = group Project Owners
 	label-Code-Review = -2..+2 group Administrators
 	label-Code-Review = -2..+2 group Project Owners
+	label-Code-Review = -2..+2 group mdb/pigweed-gerrit-configplustwo-acl
 	label-Code-Review = -2..+2 group mdb/pigweed-gob-admin
 	push = group Project Owners
 	push = group mdb/pigweed-gob-admin-acl
@@ -64,8 +65,6 @@
 	value = 0 No score
 	value = +1 Looks good to me, but someone else must approve
 	value = +2 Looks good to me, approved
-[capability]
-	administrateServer = group Administrators
 [accounts]
 	sameGroupVisibility = deny group google/google-union:signcla
 [contributor-agreement "Google CLA"]
@@ -73,3 +72,5 @@
 	agreementUrl = static/cla.html
 	accepted = group google/google-union:signcla
 	accepted = group mdb/google-cla-gerrit-robot-accounts
+[capability]
+	administrateServer = group Administrators