diff --git a/groups b/groups
index 86b7a96..ed041a7 100644
--- a/groups
+++ b/groups
@@ -1,6 +1,9 @@
 # UUID                                                        	Group Name
 #
+0f75ce7b38f669bed6d959336c712f75cc2e98c4                      	autoupdate-vigil-service-accounts
+466a0c3b36c53b3d3341c31147d55a78590fa07e                      	autoupdate-onboarding-service-accounts
 d6d748e455befcae20e5b0b1883b6df3f026c9ad                      	SLSA Policy Verification Service Accounts
+fd8a06f430138bfc0cabbecd35a9cc13eccaff1f                      	autoupdate-service-accounts
 global:Anonymous-Users                                        	Anonymous Users
 global:Project-Owners                                         	Project Owners
 global:Registered-Users                                       	Registered Users
diff --git a/project.config b/project.config
index 4e1d37e..af6090d 100644
--- a/project.config
+++ b/project.config
@@ -22,6 +22,8 @@
 	forgeCommitter = group Project Owners
 	forgeCommitter = group mdb/nginx-ninja
 	push = group Project Owners
+	push = group autoupdate-service-accounts
+	push = group autoupdate-vigil-service-accounts
 	push = group mdb/nginx-ninja
 	label-Code-Review = -2..+2 group Project Owners
 	label-Code-Review = -2..+2 group mdb/boringssl-committers
@@ -32,11 +34,16 @@
 	label-Code-Review = -2..+2 group mdb/usps-dev
 	label-Code-Review = -1..+1 group Registered Users
 	submit = group Project Owners
+	submit = group autoupdate-service-accounts
+	submit = group autoupdate-vigil-service-accounts
 	submit = group mdb/nginx-ninja
 	editTopicName = +force group Project Owners
 	editTopicName = +force group mdb/nginx-ninja
 	label-SLSA-Policy-Verified = -1..+1 group SLSA Policy Verification Service Accounts
 	Read = group SLSA Policy Verification Service Accounts
+	Read = group autoupdate-onboarding-service-accounts
+	Read = group autoupdate-service-accounts
+	Read = group autoupdate-vigil-service-accounts
 [access "refs/meta/config"]
 	exclusiveGroupPermissions = read
 	read = group Project Owners
@@ -78,6 +85,9 @@
 	accepted = group google/google-union:signcla
 [capability]
 	administrateServer = group mdb/nginx-ninja
+	viewAllAccounts = group autoupdate-onboarding-service-accounts
+	viewAllAccounts = group autoupdate-service-accounts
+	viewAllAccounts = group autoupdate-vigil-service-accounts
 [submit-requirement "Code-Review"]
 	submittableIf = label:Code-Review=MAX AND -label:Code-Review=MIN
 	canOverrideInChildProjects = true