diff --git a/inventory/group_vars/bodhi-backend b/inventory/group_vars/bodhi-backend
index fb647dddee..566d12f141 100644
--- a/inventory/group_vars/bodhi-backend
+++ b/inventory/group_vars/bodhi-backend
@@ -28,9 +28,15 @@ host_group: releng
 
 # These are consumed by a task in roles/fedmsg/base/main.yml
 fedmsg_certs:
+# This first cert is used by the push-tool.   releng members run it and it fires
+# off a simple fedmsg message that the masher (running as fedmsg-hub) is
+# listening for.  It then does all the worker.
 - service: shell
   owner: root
-  group: root
+  group: releng
+  can_send:
+  - bodhi.masher.start
+# These are certs for the masher to publish its own messages as it progresses.
 - service: bodhi
   owner: root
   group: masher
diff --git a/inventory/group_vars/bodhi-backend-stg b/inventory/group_vars/bodhi-backend-stg
index 662032dee3..1d8a77a111 100644
--- a/inventory/group_vars/bodhi-backend-stg
+++ b/inventory/group_vars/bodhi-backend-stg
@@ -27,20 +27,26 @@ host_group: releng
 
 # These are consumed by a task in roles/fedmsg/base/main.yml
 fedmsg_certs:
+# This first cert is used by the push-tool.   releng members run it and it fires
+# off a simple fedmsg message that the masher (running as fedmsg-hub) is
+# listening for.  It then does all the worker.
 - service: shell
   owner: root
-  group: root
-#- service: bodhi
-#  owner: root
-#  group: masher
-#  can_send:
-#  - bodhi.mashtask.complete
-#  - bodhi.mashtask.mashing
-#  - bodhi.mashtask.start
-#  - bodhi.mashtask.sync.done
-#  - bodhi.mashtask.sync.wait
-#  - bodhi.errata.publish
-#  - bodhi.update.eject
-#  # The ftp sync messages get run here too.
-#  - bodhi.updates.epel.sync
-#  - bodhi.updates.fedora.sync
+  group: releng
+  can_send:
+  - bodhi.masher.start
+# These are certs for the masher to publish its own messages as it progresses.
+- service: bodhi
+  owner: root
+  group: masher
+  can_send:
+  - bodhi.mashtask.complete
+  - bodhi.mashtask.mashing
+  - bodhi.mashtask.start
+  - bodhi.mashtask.sync.done
+  - bodhi.mashtask.sync.wait
+  - bodhi.errata.publish
+  - bodhi.update.eject
+  # The ftp sync messages get run here too.
+  - bodhi.updates.epel.sync
+  - bodhi.updates.fedora.sync