diff --git a/src/main/java/com/googlesource/gerrit/plugins/gitiles/FilteredRepository.java b/src/main/java/com/googlesource/gerrit/plugins/gitiles/FilteredRepository.java
index 58f2b0f..59c537a 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/gitiles/FilteredRepository.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/gitiles/FilteredRepository.java
@@ -14,8 +14,9 @@
 
 package com.googlesource.gerrit.plugins.gitiles;
 
+import static java.util.stream.Collectors.toMap;
+
 import com.google.common.collect.ImmutableList;
-import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.Maps;
 import com.google.gerrit.entities.Project;
 import com.google.gerrit.extensions.restapi.AuthException;
@@ -31,8 +32,10 @@
 import com.google.inject.Inject;
 import com.google.inject.Provider;
 import java.io.IOException;
+import java.util.Collection;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import org.eclipse.jgit.attributes.AttributesNodeProvider;
 import org.eclipse.jgit.lib.ObjectDatabase;
 import org.eclipse.jgit.lib.Ref;
@@ -65,12 +68,15 @@
 
     FilteredRepository create(Project.NameKey name)
         throws NoSuchProjectException, IOException, PermissionBackendException {
-      ProjectState projectState = projectCache.checkedGet(name);
-      if (projectState == null || !projectState.getProject().getState().permitsRead()) {
+      Optional<ProjectState> projectState = projectCache.get(name);
+      if (!projectState.get().statePermitsRead()) {
         throw new NoSuchProjectException(name);
       }
       return new FilteredRepository(
-          projectState, userProvider.get(), repoManager.openRepository(name), permissionBackend);
+          projectState.get(),
+          userProvider.get(),
+          repoManager.openRepository(name),
+          permissionBackend);
     }
   }
 
@@ -204,7 +210,10 @@
         return null;
       }
       try {
-        return perm.filter(ImmutableMap.of(name, ref), git, RefFilterOptions.defaults()).get(name);
+        return perm.filter(ImmutableList.of(ref), git, RefFilterOptions.defaults()).stream()
+            .filter(r -> r.getName().equals(name))
+            .findAny()
+            .orElse(null);
       } catch (PermissionBackendException e) {
         throw new IOException(e);
       }
@@ -212,7 +221,7 @@
 
     @Override
     public Map<String, Ref> getRefs(String prefix) throws IOException {
-      Map<String, Ref> refs;
+      Collection<Ref> refs;
       try {
         refs =
             perm.filter(
@@ -220,12 +229,8 @@
       } catch (PermissionBackendException e) {
         throw new IOException(e);
       }
-      Map<String, Ref> result = Maps.newHashMapWithExpectedSize(refs.size());
-      for (Ref ref : refs.values()) {
-        // VisibleRefFilter adds the prefix to the keys, re-strip it.
-        result.put(ref.getName().substring(prefix.length()), ref);
-      }
-      return refs;
+      // VisibleRefFilter adds the prefix to the keys, re-strip it.
+      return refs.stream().collect(toMap(r -> r.getName().substring(prefix.length()), r -> r));
     }
 
     @Override
diff --git a/src/main/java/com/googlesource/gerrit/plugins/gitiles/GerritGitilesAccess.java b/src/main/java/com/googlesource/gerrit/plugins/gitiles/GerritGitilesAccess.java
index a9196ef..d89b748 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/gitiles/GerritGitilesAccess.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/gitiles/GerritGitilesAccess.java
@@ -37,6 +37,7 @@
 import java.io.IOException;
 import java.util.Collections;
 import java.util.Map;
+import java.util.Optional;
 import java.util.Set;
 import javax.servlet.http.HttpServletRequest;
 import org.eclipse.jgit.errors.ConfigInvalidException;
@@ -169,10 +170,8 @@
   @Override
   public RepositoryDescription getRepositoryDescription() throws IOException {
     Project.NameKey nameKey = Resolver.getNameKey(req);
-    ProjectState state = projectCache.get(nameKey);
-    if (state == null) {
-      throw new RepositoryNotFoundException(nameKey.get());
-    }
+    ProjectState state =
+        projectCache.get(nameKey).orElseThrow(() -> new RepositoryNotFoundException(nameKey.get()));
     return toDescription(nameKey.get(), projectJson.format(state.getProject()));
   }
 
@@ -182,15 +181,14 @@
     // of the project. For non-project access, use All-Projects as project.
     // If none of the above exists, use global gitiles.config.
     Project.NameKey nameKey = Resolver.getNameKey(req);
-    ProjectState state = projectCache.get(nameKey);
-    if (state != null) {
-      Config cfg = state.getConfig("gitiles.config").getWithInheritance();
+    Optional<ProjectState> state = projectCache.get(nameKey);
+    if (state.isPresent()) {
+      Config cfg = state.get().getConfig("gitiles.config").getWithInheritance();
       if (cfg != null && cfg.getSections().size() > 0) {
         return cfg;
       }
     } else {
-      state = projectCache.getAllProjects();
-      Config cfg = state.getConfig("gitiles.config").get();
+      Config cfg = projectCache.getAllProjects().getConfig("gitiles.config").get();
       if (cfg != null && cfg.getSections().size() > 0) {
         return cfg;
       }