diff --git a/infra/config/config.star b/infra/config/config.star
index e8e753ff68..ab57d77444 100755
--- a/infra/config/config.star
+++ b/infra/config/config.star
@@ -259,10 +259,6 @@ luci.bucket(
         acl.entry(acl.BUILDBUCKET_TRIGGERER, groups = [
             "project-webrtc-ci-schedulers",
         ]),
-        acl.entry(acl.BUILDBUCKET_TRIGGERER, groups = [
-            # Allow Pinpoint to trigger builds for bisection
-            "service-account-chromeperf",
-        ]),
     ],
 )
 
@@ -272,6 +268,10 @@ luci.bucket(
         acl.entry(acl.BUILDBUCKET_TRIGGERER, users = [
             "webrtc-ci-builder@chops-service-accounts.iam.gserviceaccount.com",
         ]),
+        acl.entry(acl.BUILDBUCKET_TRIGGERER, groups = [
+            # Allow Pinpoint to trigger builds for bisection
+            "service-account-chromeperf",
+        ]),
     ],
 )
 
diff --git a/infra/config/cr-buildbucket.cfg b/infra/config/cr-buildbucket.cfg
index 68b8432b42..5b76c44601 100644
--- a/infra/config/cr-buildbucket.cfg
+++ b/infra/config/cr-buildbucket.cfg
@@ -13,10 +13,6 @@ buckets {
     role: SCHEDULER
     group: "project-webrtc-ci-schedulers"
   }
-  acls {
-    role: SCHEDULER
-    group: "service-account-chromeperf"
-  }
   swarming {
     builders {
       name: "Android32 (M Nexus5X)"
@@ -2152,6 +2148,10 @@ buckets {
     role: SCHEDULER
     identity: "user:webrtc-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
   }
+  acls {
+    role: SCHEDULER
+    group: "service-account-chromeperf"
+  }
   swarming {
     builders {
       name: "Android32 Builder arm"
diff --git a/infra/config/realms.cfg b/infra/config/realms.cfg
index c88f5a147e..818c101b80 100644
--- a/infra/config/realms.cfg
+++ b/infra/config/realms.cfg
@@ -64,7 +64,6 @@ realms {
   bindings {
     role: "role/buildbucket.triggerer"
     principals: "group:project-webrtc-ci-schedulers"
-    principals: "group:service-account-chromeperf"
   }
   bindings {
     role: "role/resultdb.invocationCreator"
@@ -87,6 +86,7 @@ realms {
   }
   bindings {
     role: "role/buildbucket.triggerer"
+    principals: "group:service-account-chromeperf"
     principals: "user:webrtc-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
   }
   bindings {