diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 10c079ea8e1..faa54409f16 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,6 +1,9 @@
 # Lines starting with '#' are comments.
 # Each line is a file pattern followed by one or more owners.
 # https://help.github.com/articles/about-codeowners/
+#
+# Order is important; the last matching pattern takes the most
+# precedence.
 
 # Top-level catch-alls (these are weaker confidence and might need to be reassigned at some point)
 /enterprise/cmd/frontend @beyang @slimsag
@@ -113,12 +116,10 @@ tslint.config.js @felixfbecker
 /pkg/eventlogger @dadlerj
 
 # Auth
-/cmd/frontend/authz/ @beyang
 /cmd/frontend/auth/ @beyang
 /cmd/frontend/internal/auth/ @beyang
 /cmd/frontend/internal/session/ @beyang
 /cmd/frontend/external/session/session.go @beyang
-/enterprise/cmd/frontend/internal/authz @beyang
 /enterprise/cmd/frontend/auth @beyang
 /enterprise/dev/auth-provider @beyang
 /cmd/frontend/graphqlbackend/*session* @beyang
@@ -147,6 +148,11 @@ tslint.config.js @felixfbecker
 /pkg/api/ @sourcegraph/core-services
 /pkg/jsonc @tsenart @slimsag
 /pkg/extsvc @sourcegraph/core-services
+/cmd/frontend/authz/ @sourcegraph/core-services
+/enterprise/cmd/frontend/internal/authz @sourcegraph/core-services
+# authz overrides (still owned by beyang for now)
+/enterprise/cmd/frontend/internal/authz/*github* @beyang
+/enterprise/cmd/frontend/internal/authz/*gitlab* @beyang
 
 # Code nav
 /cmd/frontend/graphqlbackend/*symbols* @sourcegraph/code-nav