diff --git a/WORKSPACE b/WORKSPACE
index 563e72a..51a7f41 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -3,7 +3,7 @@
 load("//:bazlets.bzl", "load_bazlets")
 
 load_bazlets(
-    commit = "a920e0c1801a67a2e0803dc149923ff3b81ccc6a",
+    commit = "9c84d2870bf8d3f51685a289a1fc9edc3bf9dc89",
     #local_path = "/home/<user>/projects/bazlets",
 )
 
diff --git a/external_plugin_deps.bzl b/external_plugin_deps.bzl
index 58d333a..aff59ef 100644
--- a/external_plugin_deps.bzl
+++ b/external_plugin_deps.bzl
@@ -1,13 +1,13 @@
 load("//tools/bzl:maven_jar.bzl", "GERRIT", "MAVEN_CENTRAL", "MAVEN_LOCAL", "maven_jar")
 
-JGIT_VERSION = "4.7.7.201812240805-r"
+JGIT_VERSION = "4.9.8.201812241815-r"
 REPO = MAVEN_CENTRAL
 
 def external_plugin_deps():
     maven_jar(
         name = "jgit-http-apache",
         artifact = "org.eclipse.jgit:org.eclipse.jgit.http.apache:" + JGIT_VERSION,
-        sha1 = "630604166d34b5cde8c118cb77f316bfc3a97eda",
+        sha1 = "a33c9029a6ed9b0b476d0763da38d9b4ba3a0a7a",
         repository = REPO,
         unsign = True,
         exclude = [
@@ -19,7 +19,7 @@
     maven_jar(
         name = "jgit-lfs",
         artifact = "org.eclipse.jgit:org.eclipse.jgit.lfs:" + JGIT_VERSION,
-        sha1 = "5097a9f03e0ed3f9cd960401a08ddc879ee7957e",
+        sha1 = "081d5d72d927fa5897ae0bbba72fa7522d502130",
         repository = REPO,
         unsign = True,
         exclude = [
@@ -31,7 +31,7 @@
     maven_jar(
         name = "jgit-lfs-server",
         artifact = "org.eclipse.jgit:org.eclipse.jgit.lfs.server:" + JGIT_VERSION,
-        sha1 = "2b41696407db479451b6a057bb9b992573f0d400",
+        sha1 = "d12cdeb61eff7f7ce43de403fadc8a378f7d4726",
         repository = REPO,
         unsign = True,
         exclude = [
diff --git a/src/main/java/com/googlesource/gerrit/plugins/lfs/GetLfsGlobalConfig.java b/src/main/java/com/googlesource/gerrit/plugins/lfs/GetLfsGlobalConfig.java
index dcdcbac..40e00b0 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/lfs/GetLfsGlobalConfig.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/lfs/GetLfsGlobalConfig.java
@@ -14,6 +14,8 @@
 
 package com.googlesource.gerrit.plugins.lfs;
 
+import static com.google.gerrit.server.permissions.GlobalPermission.ADMINISTRATE_SERVER;
+
 import com.google.common.collect.Maps;
 import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
 import com.google.gerrit.extensions.restapi.RestApiException;
@@ -21,6 +23,7 @@
 import com.google.gerrit.server.CurrentUser;
 import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.config.AllProjectsName;
+import com.google.gerrit.server.permissions.PermissionBackend;
 import com.google.gerrit.server.project.ProjectResource;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
@@ -33,22 +36,25 @@
   private final LfsConfigurationFactory lfsConfigFactory;
   private final AllProjectsName allProjectsName;
   private final Provider<CurrentUser> self;
+  private final PermissionBackend permissionBackend;
 
   @Inject
   GetLfsGlobalConfig(
       LfsConfigurationFactory lfsConfigFactory,
       AllProjectsName allProjectsName,
-      Provider<CurrentUser> self) {
+      Provider<CurrentUser> self,
+      PermissionBackend permissionBackend) {
     this.lfsConfigFactory = lfsConfigFactory;
     this.allProjectsName = allProjectsName;
     this.self = self;
+    this.permissionBackend = permissionBackend;
   }
 
   @Override
   public LfsGlobalConfigInfo apply(ProjectResource resource) throws RestApiException {
     IdentifiedUser user = self.get().asIdentifiedUser();
     if (!(resource.getNameKey().equals(allProjectsName)
-        && user.getCapabilities().canAdministrateServer())) {
+        && permissionBackend.user(user).testOrFalse(ADMINISTRATE_SERVER))) {
       throw new ResourceNotFoundException();
     }
 
diff --git a/src/main/java/com/googlesource/gerrit/plugins/lfs/LfsApiServlet.java b/src/main/java/com/googlesource/gerrit/plugins/lfs/LfsApiServlet.java
index 3c9b4cc..d5eeddc 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/lfs/LfsApiServlet.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/lfs/LfsApiServlet.java
@@ -18,12 +18,14 @@
 import static com.google.gerrit.extensions.api.lfs.LfsDefinitions.LFS_URL_REGEX_TEMPLATE;
 import static com.google.gerrit.extensions.client.ProjectState.HIDDEN;
 import static com.google.gerrit.extensions.client.ProjectState.READ_ONLY;
+import static com.google.gerrit.server.permissions.ProjectPermission.ACCESS;
 
 import com.google.common.base.Strings;
 import com.google.gerrit.common.ProjectUtil;
 import com.google.gerrit.common.data.Capable;
 import com.google.gerrit.reviewdb.client.Project;
 import com.google.gerrit.server.CurrentUser;
+import com.google.gerrit.server.permissions.PermissionBackend;
 import com.google.gerrit.server.project.ProjectCache;
 import com.google.gerrit.server.project.ProjectControl;
 import com.google.gerrit.server.project.ProjectState;
@@ -51,10 +53,9 @@
   private static final Logger log = LoggerFactory.getLogger(LfsApiServlet.class);
   private static final long serialVersionUID = 1L;
   private static final Pattern URL_PATTERN = Pattern.compile(LFS_OBJECTS_REGEX_REST);
-  private static final String DOWNLOAD = "download";
-  private static final String UPLOAD = "upload";
 
   private final ProjectCache projectCache;
+  private final PermissionBackend permissionBackend;
   private final LfsConfigurationFactory lfsConfigFactory;
   private final LfsRepositoryResolver repoResolver;
   private final LfsAuthUserProvider userProvider;
@@ -62,10 +63,12 @@
   @Inject
   LfsApiServlet(
       ProjectCache projectCache,
+      PermissionBackend permissionBackend,
       LfsConfigurationFactory lfsConfigFactory,
       LfsRepositoryResolver repoResolver,
       LfsAuthUserProvider userProvider) {
     this.projectCache = projectCache;
+    this.permissionBackend = permissionBackend;
     this.lfsConfigFactory = lfsConfigFactory;
     this.repoResolver = repoResolver;
     this.userProvider = userProvider;
@@ -85,12 +88,9 @@
     if (state == null || state.getProject().getState() == HIDDEN) {
       throw new LfsRepositoryNotFound(project.get());
     }
-    authorizeUser(
-        userProvider.getUser(auth, projName, request.getOperation()),
-        state,
-        request.getOperation());
+    authorizeUser(userProvider.getUser(auth, projName, request.getOperation()), state, request);
 
-    if (request.getOperation().equals(UPLOAD) && state.getProject().getState() == READ_ONLY) {
+    if (request.isUpload() && state.getProject().getState() == READ_ONLY) {
       throw new LfsRepositoryReadOnly(project.get());
     }
 
@@ -99,7 +99,7 @@
     // No config means we default to "not enabled".
     if (config != null && config.isEnabled()) {
       // For uploads, check object sizes against limit if configured
-      if (request.getOperation().equals(UPLOAD)) {
+      if (request.isUpload()) {
         if (config.isReadOnly()) {
           throw new LfsRepositoryReadOnly(project.get());
         }
@@ -123,12 +123,16 @@
     throw new LfsUnavailable(project.get());
   }
 
-  private void authorizeUser(CurrentUser user, ProjectState state, String operation)
+  private void authorizeUser(CurrentUser user, ProjectState state, LfsRequest request)
       throws LfsUnauthorized {
     ProjectControl control = state.controlFor(user);
-    if ((operation.equals(DOWNLOAD) && !control.isReadable())
-        || (operation.equals(UPLOAD) && Capable.OK != control.canPushToAtLeastOneRef())) {
-      String op = operation.toLowerCase();
+    if ((request.isDownload()
+            && !permissionBackend
+                .user(user)
+                .project(state.getProject().getNameKey())
+                .testOrFalse(ACCESS))
+        || (request.isUpload() && Capable.OK != control.canPushToAtLeastOneRef())) {
+      String op = request.getOperation().toLowerCase();
       String project = state.getProject().getName();
       String userName =
           Strings.isNullOrEmpty(user.getUserName()) ? "anonymous" : user.getUserName();
diff --git a/src/main/java/com/googlesource/gerrit/plugins/lfs/PutLfsGlobalConfig.java b/src/main/java/com/googlesource/gerrit/plugins/lfs/PutLfsGlobalConfig.java
index 5e81e73..5b0468f 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/lfs/PutLfsGlobalConfig.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/lfs/PutLfsGlobalConfig.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.lfs;
 
+import static com.google.gerrit.server.permissions.GlobalPermission.ADMINISTRATE_SERVER;
 import static com.googlesource.gerrit.plugins.lfs.LfsProjectConfigSection.KEY_BACKEND;
 import static com.googlesource.gerrit.plugins.lfs.LfsProjectConfigSection.KEY_ENABLED;
 import static com.googlesource.gerrit.plugins.lfs.LfsProjectConfigSection.KEY_MAX_OBJECT_SIZE;
@@ -30,6 +31,7 @@
 import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.config.AllProjectsName;
 import com.google.gerrit.server.git.MetaDataUpdate;
+import com.google.gerrit.server.permissions.PermissionBackend;
 import com.google.gerrit.server.project.ProjectResource;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
@@ -47,6 +49,7 @@
 
   private final String pluginName;
   private final AllProjectsName allProjectsName;
+  private final PermissionBackend permissionBackned;
   private final Provider<CurrentUser> self;
   private final Provider<MetaDataUpdate.User> metaDataUpdateFactory;
   private final LfsConfigurationFactory lfsConfigFactory;
@@ -56,12 +59,14 @@
   PutLfsGlobalConfig(
       @PluginName String pluginName,
       AllProjectsName allProjectsName,
+      PermissionBackend permissionBackned,
       Provider<CurrentUser> self,
       Provider<MetaDataUpdate.User> metaDataUpdateFactory,
       LfsConfigurationFactory lfsConfigFactory,
       GetLfsGlobalConfig get) {
     this.pluginName = pluginName;
     this.allProjectsName = allProjectsName;
+    this.permissionBackned = permissionBackned;
     this.self = self;
     this.metaDataUpdateFactory = metaDataUpdateFactory;
     this.lfsConfigFactory = lfsConfigFactory;
@@ -74,7 +79,8 @@
     IdentifiedUser user = self.get().asIdentifiedUser();
     Project.NameKey projectName = resource.getNameKey();
 
-    if (!(projectName.equals(allProjectsName) && user.getCapabilities().canAdministrateServer())) {
+    if (!(projectName.equals(allProjectsName)
+        && permissionBackned.user(user).testOrFalse(ADMINISTRATE_SERVER))) {
       throw new ResourceNotFoundException();
     }
 
diff --git a/src/main/java/com/googlesource/gerrit/plugins/lfs/locks/LfsGetLocksAction.java b/src/main/java/com/googlesource/gerrit/plugins/lfs/locks/LfsGetLocksAction.java
index e30703e..32616f6 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/lfs/locks/LfsGetLocksAction.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/lfs/locks/LfsGetLocksAction.java
@@ -16,10 +16,14 @@
 
 import static com.google.gerrit.extensions.api.lfs.LfsDefinitions.LFS_LOCKS_PATH_REGEX;
 import static com.google.gerrit.extensions.api.lfs.LfsDefinitions.LFS_URL_REGEX_TEMPLATE;
+import static com.google.gerrit.server.permissions.ProjectPermission.ACCESS;
 
 import com.google.common.base.Strings;
+import com.google.gerrit.extensions.restapi.AuthException;
 import com.google.gerrit.reviewdb.client.Project;
 import com.google.gerrit.server.CurrentUser;
+import com.google.gerrit.server.permissions.PermissionBackend;
+import com.google.gerrit.server.permissions.PermissionBackendException;
 import com.google.gerrit.server.project.ProjectCache;
 import com.google.gerrit.server.project.ProjectControl;
 import com.google.gerrit.server.project.ProjectState;
@@ -38,13 +42,17 @@
   static final Pattern LFS_LOCKS_URL_PATTERN =
       Pattern.compile(String.format(LFS_URL_REGEX_TEMPLATE, LFS_LOCKS_PATH_REGEX));
 
+  private final PermissionBackend permissionBackend;
+
   @Inject
   LfsGetLocksAction(
+      PermissionBackend permissionBackend,
       ProjectCache projectCache,
       LfsAuthUserProvider userProvider,
       LfsLocksHandler handler,
       @Assisted LfsLocksContext context) {
     super(projectCache, userProvider, handler, context);
+    this.permissionBackend = permissionBackend;
   }
 
   @Override
@@ -59,7 +67,12 @@
 
   @Override
   protected void authorizeUser(ProjectControl control) throws LfsUnauthorized {
-    if (!control.isReadable()) {
+    try {
+      permissionBackend
+          .user(control.getUser())
+          .project(control.getProject().getNameKey())
+          .check(ACCESS);
+    } catch (AuthException | PermissionBackendException e) {
       throwUnauthorizedOp("list locks", control);
     }
   }