diff --git a/src/config/repoAccess.ts b/src/config/repoAccess.ts
index 8bb61b1..3fe85b4 100644
--- a/src/config/repoAccess.ts
+++ b/src/config/repoAccess.ts
@@ -115,6 +115,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'interest-groups', permission: 'triage' },
       { team: 'java-sdk', permission: 'triage' },
       { team: 'kotlin-sdk', permission: 'triage' },
+      { team: 'maintainers', permission: 'push' },
       { team: 'moderators', permission: 'maintain' },
       { team: 'php-sdk', permission: 'triage' },
       { team: 'python-sdk', permission: 'triage' },
@@ -384,6 +385,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'lead-maintainers', permission: 'maintain' },
       { team: 'core-maintainers', permission: 'admin' },
       { team: 'steering-committee', permission: 'maintain' },
+      { team: 'maintainers', permission: 'pull' },
     ],
     users: [{ username: 'sambhav', permission: 'admin' }],
   },
diff --git a/src/config/roles.ts b/src/config/roles.ts
index 6f032cd..d58b650 100644
--- a/src/config/roles.ts
+++ b/src/config/roles.ts
@@ -123,6 +123,8 @@ export const ROLES: readonly Role[] = [
   {
     id: ROLE_IDS.MAINTAINERS,
     description: 'General maintainers',
+    // No parent team: must not inherit steering-committee repo permissions
+    github: { team: 'maintainers' },
     discord: { role: 'maintainers (synced)' },
     // GWS user accounts are opt-in: maintainers add firstName/lastName/googleEmailPrefix
     // to their entry in users.ts via PR to get an @modelcontextprotocol.io account