diff --git a/BUILD b/BUILD
index aa06995..72a3f97 100644
--- a/BUILD
+++ b/BUILD
@@ -14,7 +14,7 @@
     srcs = glob(["src/main/java/**/*.java"]),
     manifest_entries = [
         "Gerrit-PluginName: " + plugin_name,
-        "Gerrit-ApiVersion: 2.14.21",
+        "Gerrit-ApiVersion: 2.15.21",
         "Implementation-Title: Events Plugin",
         "Implementation-URL: https://gerrit-review.googlesource.com/#/admin/projects/plugins/" + plugin_name,
         "Gerrit-Module: com.googlesource.gerrit.plugins.events.Module",
diff --git a/WORKSPACE b/WORKSPACE
index 1f24d4e..43714fb 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -3,7 +3,7 @@
 load("//:bazlets.bzl", "load_bazlets")
 
 load_bazlets(
-    commit = "78c35a7eb33ee5ea0980923e246c7dba37347193",
+    commit = "9af263722b7eafe99af079d6ef7cf1de23e6f8d7",
 )
 
 load(
diff --git a/src/main/java/com/googlesource/gerrit/plugins/events/BranchHelper.java b/src/main/java/com/googlesource/gerrit/plugins/events/BranchHelper.java
index c03be80..a30b758 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/events/BranchHelper.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/events/BranchHelper.java
@@ -17,8 +17,10 @@
 import com.google.gerrit.reviewdb.client.Branch;
 import com.google.gerrit.reviewdb.client.Project;
 import com.google.gerrit.server.IdentifiedUser;
+import com.google.gerrit.server.permissions.PermissionBackend;
+import com.google.gerrit.server.permissions.PermissionBackendException;
+import com.google.gerrit.server.permissions.RefPermission;
 import com.google.gerrit.server.project.ProjectCache;
-import com.google.gerrit.server.project.ProjectControl;
 import com.google.gerrit.server.project.ProjectState;
 import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
@@ -26,17 +28,24 @@
 
 public class BranchHelper {
   protected final ProjectCache projectCache;
+  protected final PermissionBackend permissionBackend;
 
   @Inject
-  BranchHelper(ProjectCache projectCache) {
+  BranchHelper(ProjectCache projectCache, PermissionBackend permissionBackend) {
     this.projectCache = projectCache;
+    this.permissionBackend = permissionBackend;
   }
 
   public boolean isVisibleTo(JsonElement event, IdentifiedUser user) {
-    return isVisibleTo(getBranch(event), user);
+    try {
+      return isVisibleTo(getBranch(event), user);
+    } catch (PermissionBackendException e) {
+      return false;
+    }
   }
 
-  public boolean isVisibleTo(Branch.NameKey branchName, IdentifiedUser user) {
+  public boolean isVisibleTo(Branch.NameKey branchName, IdentifiedUser user)
+      throws PermissionBackendException {
     if (branchName == null) {
       return false;
     }
@@ -44,7 +53,7 @@
     if (pe == null) {
       return false;
     }
-    return pe.controlFor(user).controlForRef(branchName).isVisible();
+    return permissionBackend.user(user).ref(branchName).test(RefPermission.READ);
   }
 
   public static Branch.NameKey getBranch(JsonElement event) {
diff --git a/src/main/java/com/googlesource/gerrit/plugins/events/StreamEvents.java b/src/main/java/com/googlesource/gerrit/plugins/events/StreamEvents.java
index 9fa186f..031ecb5 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/events/StreamEvents.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/events/StreamEvents.java
@@ -19,7 +19,6 @@
 import com.google.gerrit.extensions.registration.DynamicSet;
 import com.google.gerrit.extensions.registration.RegistrationHandle;
 import com.google.gerrit.server.IdentifiedUser;
-import com.google.gerrit.server.git.WorkQueue;
 import com.google.gerrit.server.git.WorkQueue.CancelableRunnable;
 import com.google.gerrit.sshd.BaseCommand;
 import com.google.gerrit.sshd.CommandMetaData;
@@ -31,6 +30,7 @@
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.util.concurrent.Future;
+import java.util.concurrent.ScheduledThreadPoolExecutor;
 import org.apache.sshd.server.Environment;
 import org.kohsuke.args4j.Option;
 import org.slf4j.Logger;
@@ -76,7 +76,7 @@
   @Option(name = "--ids", usage = "add ids to events (useful for resuming after a disconnect)")
   protected boolean includeIds = false;
 
-  @Inject @StreamCommandExecutor protected WorkQueue.Executor threadPool;
+  @Inject @StreamCommandExecutor protected ScheduledThreadPoolExecutor threadPool;
 
   @Inject protected EventStore events;
 
diff --git a/test/docker/gerrit/Dockerfile b/test/docker/gerrit/Dockerfile
index 156d9d4..87e00e9 100755
--- a/test/docker/gerrit/Dockerfile
+++ b/test/docker/gerrit/Dockerfile
@@ -1,4 +1,4 @@
-FROM gerritcodereview/gerrit:2.14.21-ubuntu16
+FROM gerritcodereview/gerrit:2.15.21-ubuntu16
 
 USER root
 
diff --git a/test/docker/run_tests/Dockerfile b/test/docker/run_tests/Dockerfile
index a68f7c8..6e8e825 100755
--- a/test/docker/run_tests/Dockerfile
+++ b/test/docker/run_tests/Dockerfile
@@ -6,7 +6,7 @@
 ENV USER_HOME /home/$USER
 ENV WORKSPACE $USER_HOME/workspace
 
-RUN apk --update add --no-cache openssh bash git util-linux openssl shadow
+RUN apk --update add --no-cache openssh bash git util-linux openssl shadow curl
 RUN echo "StrictHostKeyChecking no" >> /etc/ssh/ssh_config
 
 RUN groupadd -f -g $GID users2
diff --git a/test/docker/run_tests/start.sh b/test/docker/run_tests/start.sh
index de065db..e7bde14 100755
--- a/test/docker/run_tests/start.sh
+++ b/test/docker/run_tests/start.sh
@@ -27,4 +27,13 @@
      --ssh-key - --email "gerrit_admin@localdomain"  --group "Administrators" "gerrit_admin"
 
 setup_test_project
+
+HTTP_PASSWD=$(uuidgen)
+ssh -p 29418 "$GERRIT_HOST" gerrit set-account "$USER" --http-password "$HTTP_PASSWD"
+cat <<EOT >> ~/.netrc
+machine $GERRIT_HOST
+login $USER
+password $HTTP_PASSWD
+EOT
+
 ./test_events_plugin.sh --server "$GERRIT_HOST" --project "$TEST_PROJECT"
diff --git a/test/test_events_plugin.sh b/test/test_events_plugin.sh
index ee02ded..0a2db23 100755
--- a/test/test_events_plugin.sh
+++ b/test/test_events_plugin.sh
@@ -27,13 +27,11 @@
     echo "${url##*\/}" | tr -d -c '[:digit:]'
 }
 
-create_change() { # [--dependent] [--draft] branch file [commit_message] > changenum
-    local opt_d opt_c opt_draft=false
+create_change() { # [--dependent] branch file [commit_message] > changenum
+    local opt_d opt_c
     [ "$1" = "--dependent" ] && { opt_d=$1 ; shift ; }
-    [ "$1" = "--draft" ] && { opt_draft=true ; shift ; }
     local branch=$1 tmpfile=$2 msg=$3 out rtn
     local content=$RANDOM dest=refs/for/$branch
-    "$opt_draft" && dest=refs/drafts/$branch
 
     if [ -z "$opt_d" ] ; then
         out=$(mygit fetch "$GITURL" "$branch" 2>&1) ||\
@@ -75,6 +73,30 @@
     fi
 }
 
+get_open_changes() {
+    curl --netrc --silent "$REST_API_CHANGES_URL/?q=status:open"
+}
+
+mark_change_wip() { # change
+    curl --netrc --silent \
+        --data "message=wip" "$REST_API_CHANGES_URL/$1/wip"
+}
+
+mark_change_ready() { # change
+    curl --netrc --silent \
+        --data "message=ready" "$REST_API_CHANGES_URL/$1/ready"
+}
+
+mark_change_private() { # change
+    curl --netrc --silent \
+        --data "message=private" "$REST_API_CHANGES_URL/$1/private"
+}
+
+unmark_change_private() { # change
+    curl -X DELETE --netrc --silent --header 'Content-Type: application/json' \
+        --data '{"message":"unmark_private"}' "$REST_API_CHANGES_URL/$1/private"
+}
+
 # ------------------------- Event Capturing ---------------------------
 
 kill_captures() { # sig
@@ -185,6 +207,7 @@
 mkdir -p "$TEST_DIR"
 TEST_DIR=$(readlink -f "$TEST_DIR")
 
+REST_API_CHANGES_URL="http://$SERVER:8080/a/changes"
 GITURL=ssh://$SERVER:29418/$PROJECT
 DEST_REF=$REF_BRANCH
 echo "$REF_BRANCH" | grep -q '^refs/' || DEST_REF=refs/heads/$REF_BRANCH
@@ -204,45 +227,61 @@
 
 setup_captures
 
+# We need to do an initial REST call, as the first REST call after a server is
+# brought up results in being anonymous despite providing proper authentication.
+get_open_changes
+
 RESULT=0
 
 # ------------------------- Individual Event Tests ---------------------------
 GROUP=visible-events
 type=patchset-created
-capture_events 2
-ch1=$(create_change --draft "$REF_BRANCH" "$FILE_A") || exit
-result_type "$GROUP" "$type"
-result_type "$GROUP $type" "ref-updated"
-
-type=draft-published
-capture_events
-review "$ch1,1" --publish
-result_type "$GROUP" "$type"
+capture_events 3
+ch1=$(create_change "$REF_BRANCH" "$FILE_A") || exit
+result_type "$GROUP" "$type" 1
+# The change ref and its meta ref are expected to be updated
+# For example: 'refs/changes/01/1001/1' and 'refs/changes/01/1001/meta'
+result_type "$GROUP $type" "ref-updated" 2
 
 type=change-abandoned
-capture_events
+capture_events 3
 review "$ch1,1" --abandon
 result_type "$GROUP" "$type"
 
 type=change-restored
-capture_events
+capture_events 3
 review "$ch1,1" --restore
 result_type "$GROUP" "$type"
 
 type=comment-added
-capture_events
+capture_events 2
 review "$ch1,1" --message "my_comment" $APPROVALS
 result_type "$GROUP" "$type"
 
+type=wip-state-changed
+capture_events 4
+q mark_change_wip "$ch1"
+q mark_change_ready "$ch1"
+result_type "$GROUP" "$type" 2
+
+type=private-state-changed
+capture_events 4
+q mark_change_private "$ch1"
+q unmark_change_private "$ch1"
+result_type "$GROUP" "$type" 2
+
 type=change-merged
-events_count=2
+events_count=3
 # If reviewnotes plugin is installed, an extra event of type 'ref-updated'
 # on 'refs/notes/review' is fired when a change is merged.
-is_plugin_installed reviewnotes && events_count=3
+is_plugin_installed reviewnotes && events_count="$((events_count+1))"
 capture_events "$events_count"
 submit "$ch1,1"
-result_type "$GROUP $type" "ref-updated" "$((events_count-1))"
 result_type "$GROUP" "$type"
+# The destination ref of the change, its meta ref and notes ref(if reviewnotes
+# plugin is installed) are expected to be updated.
+# For example: 'refs/heads/master', 'refs/changes/01/1001/meta' and 'refs/notes/review'
+result_type "$GROUP $type" "ref-updated" "$((events_count-1))"
 
 # reviewer-added needs to be tested via Rest-API