diff --git a/groups/restrictions.yaml b/groups/restrictions.yaml
index e3f25e0fada2..cf46460fd810 100644
--- a/groups/restrictions.yaml
+++ b/groups/restrictions.yaml
@@ -192,6 +192,7 @@ restrictions:
     allowedGroups:
       - "^sig-windows-leads@kubernetes.io$"
       - "^k8s-infra-staging-gmsa-webhook@kubernetes.io$"
+      - "^k8s-infra-staging-win-op-rdnss@kubernetes.io$"
   - path: "sig-k8s-infra/groups.yaml"
     allowedGroups:
       - "^gke-security-groups@kubernetes.io$"
diff --git a/groups/sig-windows/groups.yaml b/groups/sig-windows/groups.yaml
index f404258dd886..100a4ea8704b 100644
--- a/groups/sig-windows/groups.yaml
+++ b/groups/sig-windows/groups.yaml
@@ -44,6 +44,18 @@ groups:
       - jsturtevant@gmail.com
       - marosset@microsoft.com
 
+  - email-id: k8s-infra-staging-win-op-rdnss@kubernetes.io
+      name: k8s-infra-staging-win-op-rdnss
+      description: |-
+        ACL for staging Windows Operational Readiness
+      settings:
+        ReconcileMembers: "true"
+      members:
+        - cbelu@cloudbasesolutions.com
+        - jayunit100.apache@gmail.com
+        - jsturtevant@gmail.com
+        - marosset@microsoft.com
+
   #
   # k8s-infra owners for sig-owned subprojects
   #
diff --git a/infra/gcp/infra.yaml b/infra/gcp/infra.yaml
index d7376bd7f768..491dc9203e81 100644
--- a/infra/gcp/infra.yaml
+++ b/infra/gcp/infra.yaml
@@ -334,5 +334,6 @@ infra:
       k8s-staging-test-infra:
       k8s-staging-tg-exporter:
       k8s-staging-gmsa-webhook:
+      k8s-staging-win-op-rdnss:
       k8s-staging-gcb-untrusted:
         managed_by: infra/gcp/bash/ensure-staging-gcb-untrusted.sh
diff --git a/k8s.gcr.io/images/k8s-staging-win-op-rdnss/OWNERS b/k8s.gcr.io/images/k8s-staging-win-op-rdnss/OWNERS
new file mode 100644
index 000000000000..643a9668fedc
--- /dev/null
+++ b/k8s.gcr.io/images/k8s-staging-win-op-rdnss/OWNERS
@@ -0,0 +1,9 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+- sig-windows-leads
+reviewers:
+- sig-windows-leads
+
+labels:
+- sig/windows
diff --git a/k8s.gcr.io/images/k8s-staging-win-op-rdnss/images.yaml b/k8s.gcr.io/images/k8s-staging-win-op-rdnss/images.yaml
new file mode 100644
index 000000000000..3cd61acb726d
--- /dev/null
+++ b/k8s.gcr.io/images/k8s-staging-win-op-rdnss/images.yaml
@@ -0,0 +1 @@
+# No images yet.
diff --git a/k8s.gcr.io/manifests/k8s-staging-win-op-rdnss/promoter-manifest.yaml b/k8s.gcr.io/manifests/k8s-staging-win-op-rdnss/promoter-manifest.yaml
new file mode 100644
index 000000000000..b35e67251c25
--- /dev/null
+++ b/k8s.gcr.io/manifests/k8s-staging-win-op-rdnss/promoter-manifest.yaml
@@ -0,0 +1,10 @@
+# google group for gcr.io/k8s-staging-win-op-rdnss is kubernetes-sig-windows-leads@googlegroups.com
+registries:
+- name: gcr.io/k8s-staging-win-op-rdnss
+  src: true
+- name: us.gcr.io/k8s-artifacts-prod/windows-op-readiness
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: eu.gcr.io/k8s-artifacts-prod/windows-op-readiness
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: asia.gcr.io/k8s-artifacts-prod/windows-op-readiness
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com