diff --git a/BUILD b/BUILD
index 0a62564..230e501 100644
--- a/BUILD
+++ b/BUILD
@@ -6,7 +6,7 @@
     srcs = glob(["src/main/java/**/*.java"]),
     manifest_entries = [
         "Gerrit-PluginName: uploadvalidator",
-        "Gerrit-ApiVersion: 2.16",
+        "Gerrit-ApiVersion: 3.0-SNAPSHOT",
         "Gerrit-Module: com.googlesource.gerrit.plugins.uploadvalidator.Module",
     ],
     resources = glob(["src/main/resources/**/*"]),
diff --git a/WORKSPACE b/WORKSPACE
index fd06aa5..5db6925 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -3,7 +3,7 @@
 load("//:bazlets.bzl", "load_bazlets")
 
 load_bazlets(
-    commit = "c827ba79413585ab9dfc1bbd0d7f609eedd6aa80",
+    commit = "316b66f48048c1ee05d8525568f2533cff5ea252",
     #local_path = "/home/<user>/projects/bazlets",
 )
 
diff --git a/src/main/java/com/googlesource/gerrit/plugins/uploadvalidator/ChangeEmailValidator.java b/src/main/java/com/googlesource/gerrit/plugins/uploadvalidator/ChangeEmailValidator.java
index 6deb42c..7ee8f95 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/uploadvalidator/ChangeEmailValidator.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/uploadvalidator/ChangeEmailValidator.java
@@ -23,7 +23,6 @@
 import com.google.gerrit.server.config.PluginConfigFactory;
 import com.google.gerrit.server.config.ProjectConfigEntry;
 import com.google.gerrit.server.events.CommitReceivedEvent;
-import com.google.gerrit.server.git.GitRepositoryManager;
 import com.google.gerrit.server.git.validators.CommitValidationException;
 import com.google.gerrit.server.git.validators.CommitValidationListener;
 import com.google.gerrit.server.git.validators.CommitValidationMessage;
@@ -69,18 +68,15 @@
   public static final String KEY_ALLOWED_COMMITTER_EMAIL_PATTERN = "allowedCommitterEmailPattern";
   private final String pluginName;
   private final PluginConfigFactory cfgFactory;
-  private final GitRepositoryManager repoManager;
   private final ValidatorConfig validatorConfig;
 
   @Inject
   ChangeEmailValidator(
       @PluginName String pluginName,
       PluginConfigFactory cfgFactory,
-      GitRepositoryManager repoManager,
       ValidatorConfig validatorConfig) {
     this.pluginName = pluginName;
     this.cfgFactory = cfgFactory;
-    this.repoManager = repoManager;
     this.validatorConfig = validatorConfig;
   }
 
diff --git a/src/main/java/com/googlesource/gerrit/plugins/uploadvalidator/ValidatorConfig.java b/src/main/java/com/googlesource/gerrit/plugins/uploadvalidator/ValidatorConfig.java
index c4ae334..8f9330d 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/uploadvalidator/ValidatorConfig.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/uploadvalidator/ValidatorConfig.java
@@ -15,7 +15,8 @@
 package com.googlesource.gerrit.plugins.uploadvalidator;
 
 import com.google.gerrit.common.Nullable;
-import com.google.gerrit.common.data.RefConfigSection;
+import com.google.gerrit.common.data.AccessSection;
+import com.google.gerrit.exceptions.StorageException;
 import com.google.gerrit.extensions.annotations.Exports;
 import com.google.gerrit.extensions.api.projects.ProjectConfigEntryType;
 import com.google.gerrit.reviewdb.client.AccountGroup;
@@ -26,7 +27,6 @@
 import com.google.gerrit.server.group.InternalGroup;
 import com.google.gerrit.server.project.RefPatternMatcher;
 import com.google.gerrit.server.query.group.InternalGroupQuery;
-import com.google.gwtorm.server.OrmException;
 import com.google.inject.AbstractModule;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
@@ -103,7 +103,7 @@
       PluginConfig config, String refKey, Project.NameKey projectName) {
     boolean valid = true;
     for (String refPattern : config.getStringList(refKey)) {
-      if (!RefConfigSection.isValid(refPattern)) {
+      if (!AccessSection.isValidRefSectionName(refPattern)) {
         log.error(
             "Invalid {} name/pattern/regex '{}' in {} project's plugin config",
             refKey,
@@ -198,7 +198,7 @@
     public Optional<InternalGroup> get(AccountGroup.NameKey groupName) {
       try {
         return groupQueryProvider.get().byName(groupName);
-      } catch (OrmException e) {
+      } catch (StorageException e) {
         log.warn(String.format("Cannot lookup group %s by name", groupName.get()), e);
       }
       return Optional.empty();
diff --git a/src/main/resources/Documentation/config.md b/src/main/resources/Documentation/config.md
index 95c6775..e1cf169 100644
--- a/src/main/resources/Documentation/config.md
+++ b/src/main/resources/Documentation/config.md
@@ -307,7 +307,27 @@
     Multiple values are supported.
     Default: nobody is allowed to skip the rules (empty).
 
-    NOTE: When skipGroup isn't defined, all the other skip settings are ignored.
+NOTE: When skipGroup isn't defined, all the other skip settings are ignored.
+
+NOTE: For [system groups](../../../Documentation/access-control.html#system_groups)
+and external groups (e.g.
+[LDAP groups](../../../Documentation/access-control.html#ldap_groups)) the use
+of UUIDs is required. This is because group names are resolved through the
+group index and the group index only contains Gerrit internal groups.
+
+Example for system group:
+
+```
+   [plugin "@PLUGIN@"]
+     skipGroup = global:Registered-Users
+```
+
+Example for external group:
+
+```
+   [plugin "@PLUGIN@"]
+     skipGroup = ldap:Foo
+```
 
 plugin.@PLUGIN@.skipRef
 :    Ref name, pattern or regexp of the branch to skip.