diff --git a/groups/restrictions.yaml b/groups/restrictions.yaml
index 8f010aeb7e0..d8903f0d17b 100644
--- a/groups/restrictions.yaml
+++ b/groups/restrictions.yaml
@@ -24,6 +24,7 @@ restrictions:
       - "^k8s-infra-staging-storage-migrator@kubernetes.io$"
       - "^sig-api-machinery-cel-dev@kubernetes.io$"
       - "^k8s-infra-staging-kubebuilder@kubernetes.io$"
+      - "^k8s-infra-staging-controller-tools@kubernetes.io$"
       - "^sig-api-machinery-leads@kubernetes.io$"
       - "^sig-api-machinery@kubernetes.io$"
   - path: "sig-apps/groups.yaml"
diff --git a/groups/sig-api-machinery/groups.yaml b/groups/sig-api-machinery/groups.yaml
index e7c24229803..ea376a9e9d9 100644
--- a/groups/sig-api-machinery/groups.yaml
+++ b/groups/sig-api-machinery/groups.yaml
@@ -123,6 +123,17 @@ groups:
     - ricardo.katz@gmail.com
     - varshaprasad96@gmail.com
 
+- email-id: k8s-infra-staging-controller-tools@kubernetes.io
+  name: k8s-infra-staging-controller-tools
+  description: |-
+    ACL for staging controller-tools
+  settings:
+    ReconcileMembers: "true"
+  members:
+    - sbueringer@gmail.com
+    - vince@prigna.com
+    - alv2412+k8sinfra@googlemail.com
+
   #
   # k8s-infra gcs write access
   #
diff --git a/infra/gcp/infra.yaml b/infra/gcp/infra.yaml
index 91809b1b980..ef3bccc7c7a 100644
--- a/infra/gcp/infra.yaml
+++ b/infra/gcp/infra.yaml
@@ -327,6 +327,7 @@ infra:
       k8s-staging-cluster-api-gcp:
       k8s-staging-cluster-api-helm:
       k8s-staging-cluster-api-nested:
+      k8s-staging-controller-tools:
       k8s-staging-coredns:
       k8s-staging-cpa:
       k8s-staging-cri-tools: