Modify access rules
diff --git a/groups b/groups
index 100bcf4..fdae890 100644
--- a/groups
+++ b/groups
@@ -2,6 +2,7 @@
 #
 147b3de9543270b1b23526883b1bf91ec5ad42a0	Administrators
 2711f8677a316d19c7f15f30bcf25c2ffb706ead	Service Users
+9a7e5e194b8feac1691d167b37e2086a7ce1b462	Master pushers
 b588ccf0327cd98b42a4ac07213796de29f6205b	sysmocom branch access
 efb7efcf88b93f6d088d65a0194aee75e20381fd	Tag Delete/Overwrite
 f3f46fd3a6951dd36adfab6c1a6ebfced2d45e78	known users
diff --git a/project.config b/project.config
index 3ac29cc..dc5ff31 100644
--- a/project.config
+++ b/project.config
@@ -43,8 +43,8 @@
 	editTopicName = +force group Project Owners
 	editTopicName = group known users
 	label-Verified = -1..+1 group Administrators
-	label-Verified = -1..+1 group Service Users
 	label-Verified = -1..+1 group Project Owners
+	label-Verified = -1..+1 group Service Users
 	label-Verified = -1..+1 group known users
 [access "refs/meta/config"]
 	exclusiveGroupPermissions = read
@@ -109,9 +109,7 @@
 	push = +force group sysmocom branch access
 	exclusiveGroupPermissions = create forgeAuthor push
 [access "refs/heads/master"]
-	exclusiveGroupPermissions = push
-	push = +force group Administrators
-	push = group Project Owners
+	push = group Master pushers
 [access "refs/for/*"]
 	addPatchSet = group Registered Users
 [capability]