diff --git a/config/auth.go b/config/auth.go
index 1a772e27c27384e692d40d6be48cd147f9e62c09..879f694dda189fc7ebbae0a9490cc296b4842698 100644
--- a/config/auth.go
+++ b/config/auth.go
@@ -38,9 +38,14 @@ func (cfg *Config) accessForKey(repo string, pk ssh.PublicKey) gm.AccessLevel {
 					return gm.ReadWriteAccess
 				}
 			}
-			return gm.ReadOnlyAccess
+			if repo != "config" {
+				return gm.ReadOnlyAccess
+			}
 		}
 	}
+	if repo == "config" && (cfg.AnonAccess != "read-write") {
+		return gm.NoAccess
+	}
 	switch cfg.AnonAccess {
 	case "no-access":
 		return gm.NoAccess