diff --git a/cts/schemas/test-3/ref.err/acl-drop.ref.err-1 b/cts/schemas/test-3/ref.err/acl-drop.ref.err-1
index e69de29bb2..a2e1bf669f 100644
--- a/cts/schemas/test-3/ref.err/acl-drop.ref.err-1
+++ b/cts/schemas/test-3/ref.err/acl-drop.ref.err-1
@@ -0,0 +1 @@
+WARNING: Dropping nvpair cib-bootstrap-options-remove-after-stop because the remove-after-stop property is unsupported
diff --git a/cts/schemas/test-3/ref.err/acl-drop.ref.err-4 b/cts/schemas/test-3/ref.err/acl-drop.ref.err-4
index e69de29bb2..801a486a2b 100644
--- a/cts/schemas/test-3/ref.err/acl-drop.ref.err-4
+++ b/cts/schemas/test-3/ref.err/acl-drop.ref.err-4
@@ -0,0 +1 @@
+WARNING: Dropping resource rsc2 because nagios resources are no longer supported
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-99 b/cts/schemas/test-3/ref/acl-drop.ref-99
index 96c9f4fb1c..952a450f6b 100644
--- a/cts/schemas/test-3/ref/acl-drop.ref-99
+++ b/cts/schemas/test-3/ref/acl-drop.ref-99
@@ -1,56 +1,56 @@
 <cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0">
   <configuration>
     <!-- The essential elements of this test are:
          * There is a remove-after-stop property that will be dropped.
          * There is a location constraint that will be replaced by two new
            location constraints, such that the original constraint ID no longer
            exists.
          * There is a nagios resource that will be dropped, and it contains a
            meta_attributes block.
          * There is an OCF resource that will be kept.
          * There are ACL permissions that refer directly to the
            remove-after-stop element and original location constraint mentioned
            listed above.
          * There is an ACL permissions that refers directly to the
            meta_attributes block nested within the nagios resource.
          * There is an ACL permission that refers directly to the OCF resource.
          * There is an ACL permission that refers directly to the ACL permission
            for the remove-after-stop property.
 
          In this situation, the ACL permissions that refer to the dropped
          remove-after-stop element, the dropped location constraint, and the
          meta_attributes block within the nagios resource should have their
          reference attributes replaced with "xpath='/*[false()]'", which doesn't
          match anything. The other ACL permissions should remain unchanged.
       -->
     <crm_config>
       <cluster_property_set id="cib-bootstrap-options"/>
     </crm_config>
     <nodes/>
     <resources>
       <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy"/>
     </resources>
     <constraints>
       <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-1" rsc="rsc1">
         <rule id="rsc1-loc-rule-1" score="INFINITY">
           <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01"/>
         </rule>
       </rsc_location>
       <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-2" rsc="rsc1">
         <rule id="rsc1-loc-rule-2" score="INFINITY">
           <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01"/>
         </rule>
       </rsc_location>
     </constraints>
     <acls>
       <acl_role id="role1">
-        <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop"/>
-        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc"/>
-        <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes"/>
+        <acl_permission id="role1-deny-property-drop" kind="deny" xpath="/*[false()]"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" xpath="/*[false()]"/>
+        <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" xpath="/*[false()]"/>
         <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1"/>
         <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop"/>
       </acl_role>
     </acls>
   </configuration>
   <status/>
 </cib>
diff --git a/xml/upgrade-3.10-99.xsl b/xml/upgrade-3.10-99.xsl
index bad2ef5da8..da58a83f9d 100644
--- a/xml/upgrade-3.10-99.xsl
+++ b/xml/upgrade-3.10-99.xsl
@@ -1,71 +1,96 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
 <!--
  Use comments liberally as future maintainers may be unfamiliar with XSLT.
  -->
 
 <!--
  upgrade-3.10-99.xsl
 
  Guarantees after this transformation:
  * All attributes of type ID are unique (assuming that was the case for the
    original input XML). Any elements with id-refs that were resolved in the
    first step of the transformation pipeline have been converted back to
    id-refs. See upgrade-3.10-common.xsl for details.
+ * If an acl_permission has a reference attribute, it's a valid IDREF. This was
+   the case before the transformation pipeline began, but element removals in
+   earlier stages may have invalidated some ACL permissions.
 
  This file is numbered 99 because it must be the last stylesheet in the
  pipeline. This numbering allows us to add more stylesheets without needing to
  continually rename this one. When all transformation development work is
  finished, we can re-number it.
  -->
 
 <xsl:stylesheet version="1.0"
                 xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
 
 <xsl:import href="upgrade-3.10-common.xsl"/>
 
+<!-- Index all elements by ID -->
+<xsl:key name="element_id" match="*" use="@id"/>
+
 <!-- Copy everything unaltered by default -->
 <xsl:template match="/|@*|node()">
     <xsl:call-template name="identity"/>
 </xsl:template>
 
 <!--
  If an element was converted from id-ref to the referenced element earlier in
  the upgrade transformation pipeline, convert it back to an id-ref as described
  in upgrade-3.10-common.xsl
  -->
 <xsl:template match="*[@id]">
     <!--
      Convert to an id-ref if @original is 0 or unset and
      * there is any element with the same id value and original="1", or
      * there is any preceding element with the same id value
 
      The preceding axis doesn't include ancestors. While it would likely be
      nonsense to reference an ancestor, it is allowed by the schema.
 
      The idea for the second point is that if all elements with a given id value
      have original set to "0" or unset, the first one should remain a definition
      while the rest become references.
      -->
     <xsl:choose>
         <xsl:when test="not(number(@original))
                         and (//*[(@id = current()/@id) and number(@original)]
                              or preceding::*[@id = current()/@id]
                              or ancestor::*[@id = current()/@id])">
             <xsl:copy>
                 <xsl:attribute name="id-ref">
                     <xsl:value-of select="@id"/>
                 </xsl:attribute>
             </xsl:copy>
         </xsl:when>
 
         <xsl:otherwise>
             <xsl:call-template name="identity"/>
         </xsl:otherwise>
     </xsl:choose>
 </xsl:template>
 
 <!-- Drop "original" attribute -->
 <xsl:template match="@original"/>
 
+
+<!-- ACLs -->
+
+<!--
+ "Drop" ACL permissions that refer to a nonexistent element ID.
+
+ Rather than truly dropping the permission, we replace its reference attribute
+ with an xpath attribute whose value ("/*[false()]") doesn't match anything.
+ This avoids dependency chains in which one ACL permission refers to the ID of
+ another ACL permission that is also removed at this stage.
+ -->
+<xsl:template match="acl_permission
+                     [@reference and not(key('element_id', @reference))]
+                     /@reference">
+    <xsl:attribute name="xpath">
+        <xsl:value-of select="'/*[false()]'"/>
+    </xsl:attribute>
+</xsl:template>
+
 </xsl:stylesheet>