diff --git a/cts/schemas/test-3/ref/acl-drop.ref-0 b/cts/schemas/test-3/ref/acl-drop.ref-0
index 5c9245aa23..e86863bba6 100644
--- a/cts/schemas/test-3/ref/acl-drop.ref-0
+++ b/cts/schemas/test-3/ref/acl-drop.ref-0
@@ -1,59 +1,63 @@
 <cib crm_feature_set="3.19.7" validate-with="pacemaker-3.10" epoch="8" num_updates="0" admin_epoch="0" original="1">
   <configuration original="1">
     <!-- The essential elements of this test are:
          * There is a remove-after-stop property that will be dropped.
          * There is a location constraint that will be replaced by two new
            location constraints, such that the original constraint ID no longer
            exists.
          * There is a nagios resource that will be dropped, and it contains a
            meta_attributes block.
          * There is an OCF resource that will be kept.
          * There are ACL permissions that refer directly to the
            remove-after-stop element and original location constraint mentioned
            listed above.
          * There is an ACL permissions that refers directly to the
            meta_attributes block nested within the nagios resource.
          * There is an ACL permission that refers directly to the OCF resource.
          * There is an ACL permission that refers directly to the ACL permission
            for the remove-after-stop property.
 
-         In this situation, the ACL permissions that refer to the dropped
-         remove-after-stop element, the dropped location constraint, and the
-         meta_attributes block within the nagios resource should have their
-         reference attributes replaced with "xpath='/*[false()]'", which doesn't
-         match anything. The other ACL permissions should remain unchanged.
+         In this situation:
+         * The ACL permissions that refer to the dropped remove-after-stop
+           element and the meta_attributes block within the dropped nagios
+           resource should have their reference attributes replaced with
+           "xpath='/*[false()]'", which doesn't match anything.
+         * The ACL permission that refers to the location constraint should have
+           its reference attribute replaced with an xpath attribute that matches
+           the IDs of the replacement constraints.
+         * The other ACL permissions should remain unchanged.
       -->
     <crm_config original="1">
       <cluster_property_set id="cib-bootstrap-options" original="1">
         <nvpair id="cib-bootstrap-options-remove-after-stop" name="remove-after-stop" value="false" original="1"/>
       </cluster_property_set>
     </crm_config>
     <nodes original="1"/>
     <resources original="1">
       <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy" original="1"/>
       <primitive id="rsc2" class="nagios" type="fake" original="1">
         <meta_attributes id="rsc2-meta_attributes" original="1"/>
       </primitive>
     </resources>
     <constraints original="1">
       <rsc_location id="rsc1-loc" rsc="rsc1" original="1">
         <rule id="rsc1-loc-rule-1" score="INFINITY" original="1">
           <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01" original="1"/>
         </rule>
         <rule id="rsc1-loc-rule-2" score="INFINITY" original="1">
           <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01" original="1"/>
         </rule>
       </rsc_location>
     </constraints>
     <acls original="1">
       <acl_role id="role1" original="1">
         <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop" original="1"/>
         <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc" original="1"/>
         <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes" original="1"/>
         <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1" original="1"/>
         <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop" original="1"/>
       </acl_role>
     </acls>
   </configuration>
   <status original="1"/>
 </cib>
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-1 b/cts/schemas/test-3/ref/acl-drop.ref-1
index 1f61c33951..26431a2011 100644
--- a/cts/schemas/test-3/ref/acl-drop.ref-1
+++ b/cts/schemas/test-3/ref/acl-drop.ref-1
@@ -1,57 +1,61 @@
 <cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0" original="1">
   <configuration original="1">
     <!-- The essential elements of this test are:
          * There is a remove-after-stop property that will be dropped.
          * There is a location constraint that will be replaced by two new
            location constraints, such that the original constraint ID no longer
            exists.
          * There is a nagios resource that will be dropped, and it contains a
            meta_attributes block.
          * There is an OCF resource that will be kept.
          * There are ACL permissions that refer directly to the
            remove-after-stop element and original location constraint mentioned
            listed above.
          * There is an ACL permissions that refers directly to the
            meta_attributes block nested within the nagios resource.
          * There is an ACL permission that refers directly to the OCF resource.
          * There is an ACL permission that refers directly to the ACL permission
            for the remove-after-stop property.
 
-         In this situation, the ACL permissions that refer to the dropped
-         remove-after-stop element, the dropped location constraint, and the
-         meta_attributes block within the nagios resource should have their
-         reference attributes replaced with "xpath='/*[false()]'", which doesn't
-         match anything. The other ACL permissions should remain unchanged.
+         In this situation:
+         * The ACL permissions that refer to the dropped remove-after-stop
+           element and the meta_attributes block within the dropped nagios
+           resource should have their reference attributes replaced with
+           "xpath='/*[false()]'", which doesn't match anything.
+         * The ACL permission that refers to the location constraint should have
+           its reference attribute replaced with an xpath attribute that matches
+           the IDs of the replacement constraints.
+         * The other ACL permissions should remain unchanged.
       -->
     <crm_config original="1">
       <cluster_property_set id="cib-bootstrap-options" original="1"/>
     </crm_config>
     <nodes original="1"/>
     <resources original="1">
       <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy" original="1"/>
       <primitive id="rsc2" class="nagios" type="fake" original="1">
         <meta_attributes id="rsc2-meta_attributes" original="1"/>
       </primitive>
     </resources>
     <constraints original="1">
       <rsc_location id="rsc1-loc" rsc="rsc1" original="1">
         <rule id="rsc1-loc-rule-1" score="INFINITY" original="1">
           <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01" original="1"/>
         </rule>
         <rule id="rsc1-loc-rule-2" score="INFINITY" original="1">
           <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01" original="1"/>
         </rule>
       </rsc_location>
     </constraints>
     <acls original="1">
       <acl_role id="role1" original="1">
         <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop" original="1"/>
         <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc" original="1"/>
         <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes" original="1"/>
         <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1" original="1"/>
         <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop" original="1"/>
       </acl_role>
     </acls>
   </configuration>
   <status original="1"/>
 </cib>
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-2 b/cts/schemas/test-3/ref/acl-drop.ref-2
index 5d43fa7591..35008fb7de 100644
--- a/cts/schemas/test-3/ref/acl-drop.ref-2
+++ b/cts/schemas/test-3/ref/acl-drop.ref-2
@@ -1,59 +1,63 @@
 <cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0" original="1">
   <configuration original="1">
     <!-- The essential elements of this test are:
          * There is a remove-after-stop property that will be dropped.
          * There is a location constraint that will be replaced by two new
            location constraints, such that the original constraint ID no longer
            exists.
          * There is a nagios resource that will be dropped, and it contains a
            meta_attributes block.
          * There is an OCF resource that will be kept.
          * There are ACL permissions that refer directly to the
            remove-after-stop element and original location constraint mentioned
            listed above.
          * There is an ACL permissions that refers directly to the
            meta_attributes block nested within the nagios resource.
          * There is an ACL permission that refers directly to the OCF resource.
          * There is an ACL permission that refers directly to the ACL permission
            for the remove-after-stop property.
 
-         In this situation, the ACL permissions that refer to the dropped
-         remove-after-stop element, the dropped location constraint, and the
-         meta_attributes block within the nagios resource should have their
-         reference attributes replaced with "xpath='/*[false()]'", which doesn't
-         match anything. The other ACL permissions should remain unchanged.
+         In this situation:
+         * The ACL permissions that refer to the dropped remove-after-stop
+           element and the meta_attributes block within the dropped nagios
+           resource should have their reference attributes replaced with
+           "xpath='/*[false()]'", which doesn't match anything.
+         * The ACL permission that refers to the location constraint should have
+           its reference attribute replaced with an xpath attribute that matches
+           the IDs of the replacement constraints.
+         * The other ACL permissions should remain unchanged.
       -->
     <crm_config original="1">
       <cluster_property_set id="cib-bootstrap-options" original="1"/>
     </crm_config>
     <nodes original="1"/>
     <resources original="1">
       <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy" original="1"/>
       <primitive id="rsc2" class="nagios" type="fake" original="1">
         <meta_attributes id="rsc2-meta_attributes" original="1"/>
       </primitive>
     </resources>
     <constraints original="1">
       <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-1" rsc="rsc1" original="0">
         <rule id="rsc1-loc-rule-1" score="INFINITY" original="1">
           <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01" original="1"/>
         </rule>
       </rsc_location>
       <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-2" rsc="rsc1" original="0">
         <rule id="rsc1-loc-rule-2" score="INFINITY" original="1">
           <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01" original="1"/>
         </rule>
       </rsc_location>
     </constraints>
     <acls original="1">
       <acl_role id="role1" original="1">
         <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop" original="1"/>
-        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc" original="1"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" xpath="*[@id = 'pcmk__3_10_upgrade-rsc1-loc-1' or @id = 'pcmk__3_10_upgrade-rsc1-loc-2']" original="1"/>
         <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes" original="1"/>
         <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1" original="1"/>
         <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop" original="1"/>
       </acl_role>
     </acls>
   </configuration>
   <status original="1"/>
 </cib>
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-3 b/cts/schemas/test-3/ref/acl-drop.ref-3
index 5d43fa7591..35008fb7de 100644
--- a/cts/schemas/test-3/ref/acl-drop.ref-3
+++ b/cts/schemas/test-3/ref/acl-drop.ref-3
@@ -1,59 +1,63 @@
 <cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0" original="1">
   <configuration original="1">
     <!-- The essential elements of this test are:
          * There is a remove-after-stop property that will be dropped.
          * There is a location constraint that will be replaced by two new
            location constraints, such that the original constraint ID no longer
            exists.
          * There is a nagios resource that will be dropped, and it contains a
            meta_attributes block.
          * There is an OCF resource that will be kept.
          * There are ACL permissions that refer directly to the
            remove-after-stop element and original location constraint mentioned
            listed above.
          * There is an ACL permissions that refers directly to the
            meta_attributes block nested within the nagios resource.
          * There is an ACL permission that refers directly to the OCF resource.
          * There is an ACL permission that refers directly to the ACL permission
            for the remove-after-stop property.
 
-         In this situation, the ACL permissions that refer to the dropped
-         remove-after-stop element, the dropped location constraint, and the
-         meta_attributes block within the nagios resource should have their
-         reference attributes replaced with "xpath='/*[false()]'", which doesn't
-         match anything. The other ACL permissions should remain unchanged.
+         In this situation:
+         * The ACL permissions that refer to the dropped remove-after-stop
+           element and the meta_attributes block within the dropped nagios
+           resource should have their reference attributes replaced with
+           "xpath='/*[false()]'", which doesn't match anything.
+         * The ACL permission that refers to the location constraint should have
+           its reference attribute replaced with an xpath attribute that matches
+           the IDs of the replacement constraints.
+         * The other ACL permissions should remain unchanged.
       -->
     <crm_config original="1">
       <cluster_property_set id="cib-bootstrap-options" original="1"/>
     </crm_config>
     <nodes original="1"/>
     <resources original="1">
       <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy" original="1"/>
       <primitive id="rsc2" class="nagios" type="fake" original="1">
         <meta_attributes id="rsc2-meta_attributes" original="1"/>
       </primitive>
     </resources>
     <constraints original="1">
       <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-1" rsc="rsc1" original="0">
         <rule id="rsc1-loc-rule-1" score="INFINITY" original="1">
           <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01" original="1"/>
         </rule>
       </rsc_location>
       <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-2" rsc="rsc1" original="0">
         <rule id="rsc1-loc-rule-2" score="INFINITY" original="1">
           <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01" original="1"/>
         </rule>
       </rsc_location>
     </constraints>
     <acls original="1">
       <acl_role id="role1" original="1">
         <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop" original="1"/>
-        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc" original="1"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" xpath="*[@id = 'pcmk__3_10_upgrade-rsc1-loc-1' or @id = 'pcmk__3_10_upgrade-rsc1-loc-2']" original="1"/>
         <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes" original="1"/>
         <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1" original="1"/>
         <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop" original="1"/>
       </acl_role>
     </acls>
   </configuration>
   <status original="1"/>
 </cib>
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-4 b/cts/schemas/test-3/ref/acl-drop.ref-4
index cf272a5716..da489701a5 100644
--- a/cts/schemas/test-3/ref/acl-drop.ref-4
+++ b/cts/schemas/test-3/ref/acl-drop.ref-4
@@ -1,56 +1,60 @@
 <cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0" original="1">
   <configuration original="1">
     <!-- The essential elements of this test are:
          * There is a remove-after-stop property that will be dropped.
          * There is a location constraint that will be replaced by two new
            location constraints, such that the original constraint ID no longer
            exists.
          * There is a nagios resource that will be dropped, and it contains a
            meta_attributes block.
          * There is an OCF resource that will be kept.
          * There are ACL permissions that refer directly to the
            remove-after-stop element and original location constraint mentioned
            listed above.
          * There is an ACL permissions that refers directly to the
            meta_attributes block nested within the nagios resource.
          * There is an ACL permission that refers directly to the OCF resource.
          * There is an ACL permission that refers directly to the ACL permission
            for the remove-after-stop property.
 
-         In this situation, the ACL permissions that refer to the dropped
-         remove-after-stop element, the dropped location constraint, and the
-         meta_attributes block within the nagios resource should have their
-         reference attributes replaced with "xpath='/*[false()]'", which doesn't
-         match anything. The other ACL permissions should remain unchanged.
+         In this situation:
+         * The ACL permissions that refer to the dropped remove-after-stop
+           element and the meta_attributes block within the dropped nagios
+           resource should have their reference attributes replaced with
+           "xpath='/*[false()]'", which doesn't match anything.
+         * The ACL permission that refers to the location constraint should have
+           its reference attribute replaced with an xpath attribute that matches
+           the IDs of the replacement constraints.
+         * The other ACL permissions should remain unchanged.
       -->
     <crm_config original="1">
       <cluster_property_set id="cib-bootstrap-options" original="1"/>
     </crm_config>
     <nodes original="1"/>
     <resources original="1">
       <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy" original="1"/>
     </resources>
     <constraints original="1">
       <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-1" rsc="rsc1" original="0">
         <rule id="rsc1-loc-rule-1" score="INFINITY" original="1">
           <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01" original="1"/>
         </rule>
       </rsc_location>
       <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-2" rsc="rsc1" original="0">
         <rule id="rsc1-loc-rule-2" score="INFINITY" original="1">
           <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01" original="1"/>
         </rule>
       </rsc_location>
     </constraints>
     <acls original="1">
       <acl_role id="role1" original="1">
         <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop" original="1"/>
-        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc" original="1"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" xpath="*[@id = 'pcmk__3_10_upgrade-rsc1-loc-1' or @id = 'pcmk__3_10_upgrade-rsc1-loc-2']" original="1"/>
         <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes" original="1"/>
         <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1" original="1"/>
         <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop" original="1"/>
       </acl_role>
     </acls>
   </configuration>
   <status original="1"/>
 </cib>
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-99 b/cts/schemas/test-3/ref/acl-drop.ref-99
index 952a450f6b..2d1e515936 100644
--- a/cts/schemas/test-3/ref/acl-drop.ref-99
+++ b/cts/schemas/test-3/ref/acl-drop.ref-99
@@ -1,56 +1,60 @@
 <cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0">
   <configuration>
     <!-- The essential elements of this test are:
          * There is a remove-after-stop property that will be dropped.
          * There is a location constraint that will be replaced by two new
            location constraints, such that the original constraint ID no longer
            exists.
          * There is a nagios resource that will be dropped, and it contains a
            meta_attributes block.
          * There is an OCF resource that will be kept.
          * There are ACL permissions that refer directly to the
            remove-after-stop element and original location constraint mentioned
            listed above.
          * There is an ACL permissions that refers directly to the
            meta_attributes block nested within the nagios resource.
          * There is an ACL permission that refers directly to the OCF resource.
          * There is an ACL permission that refers directly to the ACL permission
            for the remove-after-stop property.
 
-         In this situation, the ACL permissions that refer to the dropped
-         remove-after-stop element, the dropped location constraint, and the
-         meta_attributes block within the nagios resource should have their
-         reference attributes replaced with "xpath='/*[false()]'", which doesn't
-         match anything. The other ACL permissions should remain unchanged.
+         In this situation:
+         * The ACL permissions that refer to the dropped remove-after-stop
+           element and the meta_attributes block within the dropped nagios
+           resource should have their reference attributes replaced with
+           "xpath='/*[false()]'", which doesn't match anything.
+         * The ACL permission that refers to the location constraint should have
+           its reference attribute replaced with an xpath attribute that matches
+           the IDs of the replacement constraints.
+         * The other ACL permissions should remain unchanged.
       -->
     <crm_config>
       <cluster_property_set id="cib-bootstrap-options"/>
     </crm_config>
     <nodes/>
     <resources>
       <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy"/>
     </resources>
     <constraints>
       <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-1" rsc="rsc1">
         <rule id="rsc1-loc-rule-1" score="INFINITY">
           <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01"/>
         </rule>
       </rsc_location>
       <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-2" rsc="rsc1">
         <rule id="rsc1-loc-rule-2" score="INFINITY">
           <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01"/>
         </rule>
       </rsc_location>
     </constraints>
     <acls>
       <acl_role id="role1">
         <acl_permission id="role1-deny-property-drop" kind="deny" xpath="/*[false()]"/>
-        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" xpath="/*[false()]"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" xpath="*[@id = 'pcmk__3_10_upgrade-rsc1-loc-1' or @id = 'pcmk__3_10_upgrade-rsc1-loc-2']"/>
         <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" xpath="/*[false()]"/>
         <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1"/>
         <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop"/>
       </acl_role>
     </acls>
   </configuration>
   <status/>
 </cib>
diff --git a/cts/schemas/test-3/xml/acl-drop.xml b/cts/schemas/test-3/xml/acl-drop.xml
index 1bf0418ebf..34817bb236 100644
--- a/cts/schemas/test-3/xml/acl-drop.xml
+++ b/cts/schemas/test-3/xml/acl-drop.xml
@@ -1,59 +1,63 @@
 <cib crm_feature_set="3.19.7" validate-with="pacemaker-3.10" epoch="8" num_updates="0" admin_epoch="0">
   <configuration>
     <!-- The essential elements of this test are:
          * There is a remove-after-stop property that will be dropped.
          * There is a location constraint that will be replaced by two new
            location constraints, such that the original constraint ID no longer
            exists.
          * There is a nagios resource that will be dropped, and it contains a
            meta_attributes block.
          * There is an OCF resource that will be kept.
          * There are ACL permissions that refer directly to the
            remove-after-stop element and original location constraint mentioned
            listed above.
          * There is an ACL permissions that refers directly to the
            meta_attributes block nested within the nagios resource.
          * There is an ACL permission that refers directly to the OCF resource.
          * There is an ACL permission that refers directly to the ACL permission
            for the remove-after-stop property.
 
-         In this situation, the ACL permissions that refer to the dropped
-         remove-after-stop element, the dropped location constraint, and the
-         meta_attributes block within the nagios resource should have their
-         reference attributes replaced with "xpath='/*[false()]'", which doesn't
-         match anything. The other ACL permissions should remain unchanged.
+         In this situation:
+         * The ACL permissions that refer to the dropped remove-after-stop
+           element and the meta_attributes block within the dropped nagios
+           resource should have their reference attributes replaced with
+           "xpath='/*[false()]'", which doesn't match anything.
+         * The ACL permission that refers to the location constraint should have
+           its reference attribute replaced with an xpath attribute that matches
+           the IDs of the replacement constraints.
+         * The other ACL permissions should remain unchanged.
       -->
     <crm_config>
       <cluster_property_set id="cib-bootstrap-options">
         <nvpair id="cib-bootstrap-options-remove-after-stop" name="remove-after-stop" value="false"/>
       </cluster_property_set>
     </crm_config>
     <nodes/>
     <resources>
       <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy"/>
       <primitive id="rsc2" class="nagios" type="fake">
         <meta_attributes id="rsc2-meta_attributes"/>
       </primitive>
     </resources>
     <constraints>
       <rsc_location id="rsc1-loc" rsc="rsc1">
         <rule id="rsc1-loc-rule-1" score="INFINITY">
           <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01"/>
         </rule>
         <rule id="rsc1-loc-rule-2" score="INFINITY">
           <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01"/>
         </rule>
       </rsc_location>
     </constraints>
     <acls>
       <acl_role id="role1">
         <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop"/>
         <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc"/>
         <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes"/>
         <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1"/>
         <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop"/>
       </acl_role>
     </acls>
   </configuration>
   <status/>
 </cib>
diff --git a/xml/upgrade-3.10-2.xsl b/xml/upgrade-3.10-2.xsl
index 4cfce8412f..b51fe44aea 100644
--- a/xml/upgrade-3.10-2.xsl
+++ b/xml/upgrade-3.10-2.xsl
@@ -1,270 +1,322 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
 <!--
  Use comments liberally as future maintainers may be unfamiliar with XSLT.
  -->
 
 <!--
  upgrade-3.10-2.xsl
 
  Guarantees after this transformation:
  * Within a given nvset, there is at most one nvpair with a given name. If there
    were duplicates prior to this transformation, only the first one is kept.
  * There are no ping nodes. If a node was a ping node prior to this
    transformation, it is now a member (cluster) node with all resources banned
    and probes disabled.
  * There are no legacy promotable clone resources. If a resource was a legacy
    promotable clone prior to this transformation, it is now a standard
    promotable clone (that is, a clone with the meta-attribute "promotable" set
    to "true").
  * There is at most one top-level rule within a location constraint. If a
    location constraint had N top-level rules (N > 1) prior to this
    transformation, it is now converted to N location constraints, each with a
    single top-level rule.
 
  Anything that matches all resource types should be placed in a later
  transformation, so that it can ignore the possibility of legacy promotable
  clone resources.
  -->
 
 <xsl:stylesheet version="1.0"
                 xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
 
 <xsl:import href="upgrade-3.10-common.xsl"/>
 
+<!-- Index all location constraints by ID -->
+<xsl:key name="location_id" match="//rsc_location" use="@id"/>
+
 <!--
  Copy everything unaltered by default, except optionally set "original"
 
  Params:
  * original: See identity template
  -->
 <xsl:template match="/|@*|node()">
     <xsl:param name="original"/>
 
     <xsl:call-template name="identity">
         <xsl:with-param name="original" select="$original"/>
     </xsl:call-template>
 </xsl:template>
 
 
 <!-- Name/value pairs -->
 
 <!--
  Ensure there is at most one nvpair with a given name in a given nvset.
 
  By dropping the ignored duplicates now, we facilitate later transformations in
  which we drop nvpairs with certain values. The later steps will involve
  comparisons among multiple nvsets. These are easier to reason about and to
  regression-test if, prior to that, we drop all but one nvpair with a given name
  in a given nvset.
  -->
 
 <!--
  Drop nvpairs with value="#default" if there is a later nvpair with the same
  name. Value "#default" unsets the option, so any later nvpair takes precedence.
 -->
 <xsl:template match="nvpair[(@value = '#default')
                             and (@name = following-sibling::*/@name)]"/>
 
 <!--
  Drop nvpairs with a value other than "#default" if certain conditions (detailed
  below) are satisfied.
  -->
 <xsl:template match="nvpair[@value != '#default']">
     <!-- All preceding sibling nvpairs with the same name -->
     <xsl:variable name="before"
                   select="preceding-sibling::nvpair[@name = current()/@name]"/>
 
     <!-- All following sibling nvpairs with the same name -->
     <xsl:variable name="after"
                   select="following-sibling::nvpair[@name = current()/@name]"/>
 
     <!--
      Last preceding sibling nvpair with the same name and value "#default"
      -->
     <xsl:variable name="last_default_before"
                   select="$before[@value = '#default'][last()]"/>
 
     <xsl:choose>
         <!--
          Drop if there's a following sibling with the same name and value
          "#default". The later "#default" value would unset the current nvpair's
          value.
          -->
         <xsl:when test="$after[@value = '#default']"/>
 
         <!--
          Drop if both:
          * There's a preceding sibling nvpair with the same name
          * Either of the following:
            * There's no preceding sibling nvpair with the same name and value
              "#default"
            * There's a preceding sibling nvpair with the same name between the
              most recent "#default" and the current node.
 
          The preceding sibling nvpair would take effect, and there is no
          "#default" value to unset it before we reach the current nvpair.
 
          This uses an XPath 1.0 set intersection idiom.
          -->
         <xsl:when test="$before
                         and (not($last_default_before)
                              or $last_default_before/following-sibling::nvpair
                                 [count(.|$before) = count($before)])"/>
 
         <!-- Otherwise, keep the nvpair -->
         <xsl:otherwise>
             <xsl:call-template name="identity"/>
         </xsl:otherwise>
     </xsl:choose>
 </xsl:template>
 
 
 <!-- Nodes -->
 
 <!--
  Transform ping nodes to cluster (member) nodes. The constraints template bans
  all resources from the newly transformed nodes.
 -->
 <xsl:template match="node[@type = 'ping']">
     <xsl:copy>
         <xsl:apply-templates select="@*"/>
         <xsl:attribute name="type">member</xsl:attribute>
         <xsl:apply-templates select="node()"/>
     </xsl:copy>
 </xsl:template>
 
 
 <!-- Resources -->
 
 <!--
  Convert master resources to clones with promotable meta-attribute set to "true"
  -->
 <xsl:template match="master">
     <xsl:element name="clone">
         <xsl:apply-templates select="@*"/>
 
         <!--
          Prepend new meta_attributes element that takes precedence over all
          others, with promotable="true"
         -->
         <xsl:element name="meta_attributes">
             <xsl:variable name="meta_id"
                           select="concat($upgrade_prefix, 'promotable-legacy-',
                                          @id, '-meta_attributes')"/>
 
             <xsl:attribute name="id">
                 <xsl:value-of select="$meta_id"/>
             </xsl:attribute>
 
             <!-- Override any manually configured meta-attributes -->
             <xsl:attribute name="score">INFINITY</xsl:attribute>
 
             <xsl:element name="nvpair">
                 <xsl:attribute name="id">
                     <xsl:value-of select="concat($meta_id, '-promotable')"/>
                 </xsl:attribute>
                 <xsl:attribute name="name">promotable</xsl:attribute>
                 <xsl:attribute name="value">true</xsl:attribute>
             </xsl:element>
         </xsl:element>
 
         <!-- Keep all existing children -->
         <xsl:apply-templates select="node()"/>
     </xsl:element>
 </xsl:template>
 
 <!--
  Rename a bundle container's masters attribute to promoted-max. (This is the
  only place the schema allows a masters attribute.)
  -->
 <xsl:template match="@masters">
     <xsl:attribute name="promoted-max">
         <xsl:value-of select="."/>
     </xsl:attribute>
 </xsl:template>
 
 
 <!-- Constraints -->
 
 <xsl:template match="constraints">
     <xsl:copy>
         <!-- Existing contents -->
         <xsl:apply-templates select="@*|node()"/>
 
         <!--
          Ban all resources from each ping node (converted to a cluster node via
          another template)
          -->
         <xsl:for-each select="//node[@type = 'ping']">
             <xsl:element name="rsc_location">
                 <xsl:attribute name="id">
                     <xsl:value-of select="concat($upgrade_prefix,
                                                  'ping-node-ban-', @uname)"/>
                 </xsl:attribute>
                 <xsl:attribute name="rsc-pattern">.*</xsl:attribute>
                 <xsl:attribute name="node">
                     <xsl:value-of select="@uname"/>
                 </xsl:attribute>
                 <xsl:attribute name="score">-INFINITY</xsl:attribute>
                 <xsl:attribute name="resource-discovery">never</xsl:attribute>
             </xsl:element>
         </xsl:for-each>
     </xsl:copy>
 </xsl:template>
 
 <!--
  If a location constraint contains multiple top-level rules, replace it with
  a set of new location constraints, one for each top-level rule.
  -->
 <xsl:template match="rsc_location[count(rule) > 1]">
     <xsl:for-each select="rule">
         <xsl:element name="rsc_location">
             <!-- Copy attributes from the original rsc_location -->
             <xsl:apply-templates select="../@*"/>
             <xsl:attribute name="original">0</xsl:attribute>
 
             <!--
              Set a probably-unique ID for the new rsc_location, based on the
              existing rsc_location's ID and the rule's position
              -->
             <xsl:attribute name="id">
                 <xsl:value-of select="concat($upgrade_prefix, ../@id, '-',
                                              position())"/>
             </xsl:attribute>
 
             <!-- Add resource sets, rule, and lifetime (in order) -->
             <xsl:choose>
                 <!--
                  The descendants of the first rsc_location created should keep
                  their "original" values from the old rsc_location, if any
                  -->
                 <xsl:when test="position() = 1">
                     <xsl:apply-templates select="../resource_set"/>
                     <xsl:apply-templates select="."/>
                     <xsl:apply-templates select="../lifetime"/>
                 </xsl:when>
 
                 <!--
                  The descendants of later rsc_location elements should all have
                  original="0" for resource_set and lifetime elements. The rule
                  element should keep its existing "original" value, since it
                  will occur in exactly one of the newly created constraints.
                  -->
                 <xsl:otherwise>
                     <xsl:apply-templates select="../resource_set">
                         <xsl:with-param name="original" select="'0'"/>
                     </xsl:apply-templates>
                     <xsl:apply-templates select=".">
                         <xsl:with-param name="original"/>
                     </xsl:apply-templates>
                     <xsl:apply-templates select="../lifetime">
                         <xsl:with-param name="original" select="'0'"/>
                     </xsl:apply-templates>
                 </xsl:otherwise>
             </xsl:choose>
         </xsl:element>
     </xsl:for-each>
 </xsl:template>
 
+
+<!-- ACLs -->
+
+<!--
+ If an ACL permission refers to a location constraint with multiple top-level
+ rules, replace the reference attribute with an xpath attribute. The xpath
+ attribute should match the IDs of all the new location constraints that replace
+ the original one.
+
+ Mirror the logic from the "rsc_location[count(rule) > 1]" template.
+-->
+<xsl:template match="acl_permission/@reference">
+    <xsl:variable name="location" select="key('location_id', .)"/>
+
+    <xsl:choose>
+        <xsl:when test="$location and $location[count(rule) > 1]">
+            <!--
+             This ACL refers to a constraint that is replaced by multiple new
+             ones. Update accordingly.
+             -->
+
+            <!-- Use variable as a hack to avoid parsing difficulties -->
+            <xsl:variable name="apos">'</xsl:variable>
+
+            <xsl:attribute name="xpath">
+                <xsl:value-of select="'*['"/>
+
+                <xsl:for-each select="$location/rule">
+                    <xsl:variable name="cons_id"
+                                  select="concat($upgrade_prefix, ../@id, '-',
+                                                 position())"/>
+
+                    <xsl:if test="position() > 1">
+                        <xsl:value-of select="' or '"/>
+                    </xsl:if>
+                    <xsl:value-of select="concat('@id = ', $apos, $cons_id,
+                                                 $apos)"/>
+                </xsl:for-each>
+
+                <xsl:value-of select="']'"/>
+            </xsl:attribute>
+        </xsl:when>
+
+        <xsl:otherwise>
+            <xsl:call-template name="identity"/>
+        </xsl:otherwise>
+    </xsl:choose>
+</xsl:template>
+
 </xsl:stylesheet>