diff --git a/src/main/java/com/googlesource/gerrit/plugins/imagare/ImageServlet.java b/src/main/java/com/googlesource/gerrit/plugins/imagare/ImageServlet.java
index 185ae63..2d5ecc8 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/imagare/ImageServlet.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/imagare/ImageServlet.java
@@ -25,9 +25,13 @@
 import com.google.gerrit.extensions.restapi.IdString;
 import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
 import com.google.gerrit.reviewdb.client.Project;
-import com.google.gerrit.reviewdb.server.ReviewDb;
+import com.google.gerrit.server.CurrentUser;
 import com.google.gerrit.server.git.GitRepositoryManager;
 import com.google.gerrit.server.mime.FileTypeRegistry;
+import com.google.gerrit.server.permissions.PermissionBackend;
+import com.google.gerrit.server.permissions.PermissionBackendException;
+import com.google.gerrit.server.permissions.RefPermission;
+import com.google.gerrit.server.project.CommitsCollection;
 import com.google.gerrit.server.project.GetHead;
 import com.google.gerrit.server.project.NoSuchProjectException;
 import com.google.gerrit.server.project.ProjectCache;
@@ -63,29 +67,35 @@
   public static final String PATH_PREFIX = "/project/";
 
   private final String pluginName;
-  private final Provider<ReviewDb> db;
   private final ProjectControl.Factory projectControlFactory;
   private final ProjectCache projectCache;
   private final Provider<GetHead> getHead;
   private final GitRepositoryManager repoManager;
   private final FileTypeRegistry fileTypeRegistry;
+  private final CommitsCollection commits;
+  private final Provider<CurrentUser> self;
+  private final PermissionBackend permissionBackend;
 
   @Inject
   ImageServlet(
       @PluginName String pluginName,
-      Provider<ReviewDb> db,
       ProjectControl.Factory projectControlFactory,
       ProjectCache projectCache,
       Provider<GetHead> getHead,
       GitRepositoryManager repoManager,
-      FileTypeRegistry fileTypeRegistry) {
+      FileTypeRegistry fileTypeRegistry,
+      CommitsCollection commits,
+      Provider<CurrentUser> self,
+      PermissionBackend permissionBackend) {
     this.pluginName = pluginName;
-    this.db = db;
     this.projectControlFactory = projectControlFactory;
     this.projectCache = projectCache;
     this.getHead = getHead;
     this.repoManager = repoManager;
     this.fileTypeRegistry = fileTypeRegistry;
+    this.commits = commits;
+    this.self = self;
+    this.permissionBackend = permissionBackend;
   }
 
   @Override
@@ -119,7 +129,10 @@
           if (!rev.startsWith(Constants.R_REFS)) {
             rev = Constants.R_HEADS + rev;
           }
-          if (!projectControl.controlForRef(rev).isVisible()) {
+          PermissionBackend.ForProject perm = permissionBackend.user(self).project(key.project);
+          try {
+            perm.ref(rev).check(RefPermission.READ);
+          } catch (AuthException e) {
             notFound(res);
             return;
           }
@@ -135,7 +148,7 @@
         if (ObjectId.isId(rev)) {
           try (RevWalk rw = new RevWalk(repo)) {
             RevCommit commit = rw.parseCommit(repo.resolve(rev));
-            if (!projectControl.canReadCommit(db.get(), repo, commit)) {
+            if (!commits.canRead(state, repo, commit)) {
               notFound(res);
               return;
             }
@@ -193,7 +206,8 @@
         | NoSuchProjectException
         | ResourceNotFoundException
         | AuthException
-        | RevisionSyntaxException e) {
+        | RevisionSyntaxException
+        | PermissionBackendException e) {
       notFound(res);
       return;
     }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/imagare/PostImage.java b/src/main/java/com/googlesource/gerrit/plugins/imagare/PostImage.java
index f94f3ac..27ac2ae 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/imagare/PostImage.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/imagare/PostImage.java
@@ -21,7 +21,9 @@
 import com.google.gerrit.extensions.restapi.MethodNotAllowedException;
 import com.google.gerrit.extensions.restapi.ResourceConflictException;
 import com.google.gerrit.extensions.restapi.Response;
+import com.google.gerrit.extensions.restapi.RestApiException;
 import com.google.gerrit.extensions.restapi.RestModifyView;
+import com.google.gerrit.reviewdb.client.Branch;
 import com.google.gerrit.reviewdb.client.Project;
 import com.google.gerrit.server.GerritPersonIdent;
 import com.google.gerrit.server.IdentifiedUser;
@@ -30,10 +32,12 @@
 import com.google.gerrit.server.extensions.events.GitReferenceUpdated;
 import com.google.gerrit.server.git.GitRepositoryManager;
 import com.google.gerrit.server.mime.FileTypeRegistry;
+import com.google.gerrit.server.permissions.PermissionBackendException;
+import com.google.gerrit.server.project.CreateRefControl;
+import com.google.gerrit.server.project.NoSuchProjectException;
 import com.google.gerrit.server.project.ProjectControl;
 import com.google.gerrit.server.project.ProjectResource;
 import com.google.gerrit.server.project.ProjectState;
-import com.google.gerrit.server.project.RefControl;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
 import com.googlesource.gerrit.plugins.imagare.PostImage.Input;
@@ -71,6 +75,7 @@
   private final String canonicalWebUrl;
   private final Config cfg;
   private final String pluginName;
+  private final CreateRefControl createRefControl;
 
   @Inject
   public PostImage(
@@ -81,7 +86,8 @@
       @GerritPersonIdent PersonIdent myIdent,
       @CanonicalWebUrl String canonicalWebUrl,
       @GerritServerConfig Config cfg,
-      @PluginName String pluginName) {
+      @PluginName String pluginName,
+      CreateRefControl createRefControl) {
     this.registry = registry;
     this.imageDataPattern = Pattern.compile("data:([\\w/.-]+);([\\w]+),(.*)");
     this.self = self;
@@ -91,12 +97,12 @@
     this.canonicalWebUrl = canonicalWebUrl;
     this.cfg = cfg;
     this.pluginName = pluginName;
+    this.createRefControl = createRefControl;
   }
 
   @Override
   public Response<ImageInfo> apply(ProjectResource rsrc, Input input)
-      throws MethodNotAllowedException, BadRequestException, AuthException, IOException,
-          ResourceConflictException {
+      throws RestApiException, IOException, PermissionBackendException, NoSuchProjectException {
     if (input == null) {
       input = new Input();
     }
@@ -110,8 +116,7 @@
   }
 
   private ImageInfo storeImage(ProjectControl pc, String imageData, String fileName)
-      throws MethodNotAllowedException, BadRequestException, AuthException, IOException,
-          ResourceConflictException {
+      throws RestApiException, IOException, PermissionBackendException, NoSuchProjectException {
     Matcher m = imageDataPattern.matcher(imageData);
     if (m.matches()) {
       String receivedMimeType = m.group(1);
@@ -144,7 +149,8 @@
   }
 
   private String storeImage(ProjectControl pc, byte[] content, String fileName)
-      throws AuthException, IOException, ResourceConflictException {
+      throws AuthException, IOException, ResourceConflictException, PermissionBackendException,
+          NoSuchProjectException {
     long maxSize = getEffectiveMaxObjectSizeLimit(pc.getProjectState());
     // maxSize == 0 means that there is no limit
     if (maxSize > 0 && content.length > maxSize) {
@@ -152,7 +158,6 @@
     }
 
     String ref = getRef(content, fileName);
-    RefControl rc = pc.controlForRef(ref);
 
     try (Repository repo = repoManager.openRepository(pc.getProject().getNameKey())) {
       ObjectId commitId = repo.resolve(ref);
@@ -182,7 +187,13 @@
         commitId = oi.insert(cb);
         oi.flush();
 
-        if (!rc.canCreate(repo, rw.parseCommit(commitId))) {
+        try {
+          createRefControl.checkCreateRef(
+              self,
+              repo,
+              new Branch.NameKey(pc.getProject().getNameKey(), ref),
+              rw.parseCommit(commitId));
+        } catch (AuthException e) {
           throw new AuthException(
               String.format("Project %s doesn't allow image upload.", pc.getProject().getName()));
         }