diff --git a/src/test/java/com/googlesource/gerrit/plugins/gitiles/ListProjectsAccessTest.java b/src/test/java/com/googlesource/gerrit/plugins/gitiles/ListProjectsAccessTest.java
index 6a8c342..1dd4d2b 100644
--- a/src/test/java/com/googlesource/gerrit/plugins/gitiles/ListProjectsAccessTest.java
+++ b/src/test/java/com/googlesource/gerrit/plugins/gitiles/ListProjectsAccessTest.java
@@ -18,6 +18,7 @@
 import static com.google.gerrit.acceptance.testsuite.project.TestProjectUpdate.allow;
 import static com.google.gerrit.extensions.client.ProjectState.HIDDEN;
 import static com.google.gerrit.server.group.SystemGroupBackend.ANONYMOUS_USERS;
+import static com.google.gerrit.server.group.SystemGroupBackend.REGISTERED_USERS;
 
 import com.google.common.collect.ImmutableSet;
 import com.google.gerrit.acceptance.LightweightPluginDaemonTest;
@@ -76,10 +77,11 @@
     projectOperations
         .project(project)
         .forUpdate()
+        .add(allow(Permission.READ).ref("refs/heads/*").group(REGISTERED_USERS))
+        .add(allow(Permission.CREATE).ref("refs/heads/*").group(REGISTERED_USERS))
         .add(allow(Permission.READ).ref("refs/heads/visible").group(ANONYMOUS_USERS))
-        .add(allow(Permission.CREATE).ref("refs/*").group(ANONYMOUS_USERS))
-        .add(allow(Permission.PUSH).ref("refs/*").group(ANONYMOUS_USERS))
         .update();
+    requestScopeOperations.setApiUser(user.id());
     gApi.projects().name(project.get()).branch("refs/heads/visible").create(new BranchInput());
     gApi.projects().name(project.get()).branch("refs/heads/invisible").create(new BranchInput());
     requestScopeOperations.setApiUserAnonymous();
diff --git a/src/test/java/com/googlesource/gerrit/plugins/gitiles/RepositoryResolverAccessTest.java b/src/test/java/com/googlesource/gerrit/plugins/gitiles/RepositoryResolverAccessTest.java
index 110837f..1f10177 100644
--- a/src/test/java/com/googlesource/gerrit/plugins/gitiles/RepositoryResolverAccessTest.java
+++ b/src/test/java/com/googlesource/gerrit/plugins/gitiles/RepositoryResolverAccessTest.java
@@ -17,6 +17,7 @@
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.gerrit.acceptance.testsuite.project.TestProjectUpdate.allow;
 import static com.google.gerrit.server.group.SystemGroupBackend.ANONYMOUS_USERS;
+import static com.google.gerrit.server.group.SystemGroupBackend.REGISTERED_USERS;
 import static com.google.gerrit.testing.GerritJUnit.assertThrows;
 
 import com.google.gerrit.acceptance.LightweightPluginDaemonTest;
@@ -59,12 +60,14 @@
     projectOperations
         .project(project)
         .forUpdate()
+        .add(allow(Permission.READ).ref("refs/heads/*").group(REGISTERED_USERS))
+        .add(allow(Permission.CREATE).ref("refs/heads/*").group(REGISTERED_USERS))
         .add(allow(Permission.READ).ref("refs/heads/visible").group(ANONYMOUS_USERS))
-        .add(allow(Permission.CREATE).ref("refs/*").group(ANONYMOUS_USERS))
-        .add(allow(Permission.PUSH).ref("refs/*").group(ANONYMOUS_USERS))
         .update();
+    requestScopeOperations.setApiUser(user.id());
     gApi.projects().name(project.get()).branch("refs/heads/visible").create(new BranchInput());
     gApi.projects().name(project.get()).branch("refs/heads/invisible").create(new BranchInput());
+    requestScopeOperations.setApiUserAnonymous();
 
     Repository repo = resolver().open(new FakeHttpServletRequest(), project.get());
     assertThat(repo.exactRef("refs/heads/visible")).isNotNull();