diff --git a/ui.config/src/main/content/jcr_root/apps/acm-config/osgiconfig/config/org.apache.sling.jcr.repoinit.RepositoryInitializer~acmcore.config b/ui.config/src/main/content/jcr_root/apps/acm-config/osgiconfig/config/org.apache.sling.jcr.repoinit.RepositoryInitializer~acmcore.config
index 0d611f3c..7bed1ddd 100644
--- a/ui.config/src/main/content/jcr_root/apps/acm-config/osgiconfig/config/org.apache.sling.jcr.repoinit.RepositoryInitializer~acmcore.config
+++ b/ui.config/src/main/content/jcr_root/apps/acm-config/osgiconfig/config/org.apache.sling.jcr.repoinit.RepositoryInitializer~acmcore.config
@@ -28,4 +28,10 @@ scripts=["
         deny jcr:read on /apps/acm
         deny jcr:read on /apps/cq/core/content/nav/tools/acm
     end
+
+    create group acm-users
+    set ACL for acm-users
+        allow jcr:read on /apps/acm
+        allow jcr:read on /apps/cq/core/content/nav/tools/acm
+    end
 "]