diff --git a/db/migrate/20170309173138_create_protected_tags.rb b/db/migrate/20170309173138_create_protected_tags.rb
new file mode 100644
index 0000000000000000000000000000000000000000..c69ef9704109325b590151def17d7c2f35ae15fb
--- /dev/null
+++ b/db/migrate/20170309173138_create_protected_tags.rb
@@ -0,0 +1,39 @@
+class CreateProtectedTags < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  # Set this constant to true if this migration requires downtime.
+  DOWNTIME = false
+
+  GitlabAccessMaster = 40
+
+  def change
+    create_table :protected_tags do |t|
+      t.integer :project_id, null: false
+      t.string :name, null: false
+      t.string :timestamps #TODO: `null: false`? Missing from protected_branches
+    end
+
+    add_index :protected_tags, :project_id
+
+    create_table :protected_tag_merge_access_levels do |t|
+      t.references :protected_tag, index: { name: "index_protected_tag_merge_access" }, foreign_key: true, null: false
+
+      t.integer :access_level, default: GitlabAccessMaster, null: true #TODO: was false, check schema
+      t.integer :group_id #TODO: check why group/user id missing from CE
+      t.integer :user_id
+      t.timestamps null: false
+    end
+
+    create_table :protected_tag_push_access_levels do |t|
+      t.references :protected_tag, index: { name: "index_protected_tag_push_access" }, foreign_key: true, null: false
+      t.integer :access_level, default: GitlabAccessMaster, null: true #TODO: was false, check schema
+      t.integer :group_id
+      t.integer :user_id
+      t.timestamps null: false
+    end
+
+    #TODO: These had rubocop set to disable Migration/AddConcurrentForeignKey
+    # add_foreign_key :protected_tag_merge_access_levels, :namespaces, column: :group_id 
+    # add_foreign_key :protected_tag_push_access_levels, :namespaces, column: :group_id
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index f96a7d21890894f754054fe9959d1f3b40c30dc2..05b28b6a63ba42c2483074afb866197a01d81113 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20170315194013) do
+ActiveRecord::Schema.define(version: 20170317203554) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -963,6 +963,32 @@ ActiveRecord::Schema.define(version: 20170315194013) do
 
   add_index "protected_branches", ["project_id"], name: "index_protected_branches_on_project_id", using: :btree
 
+  create_table "protected_tag_merge_access_levels", force: :cascade do |t|
+    t.integer "protected_tag_id", null: false
+    t.integer "access_level", default: 40, null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+  end
+
+  add_index "protected_tag_merge_access_levels", ["protected_tag_id"], name: "index_protected_tag_merge_access", using: :btree
+
+  create_table "protected_tag_push_access_levels", force: :cascade do |t|
+    t.integer "protected_tag_id", null: false
+    t.integer "access_level", default: 40, null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+  end
+
+  add_index "protected_tag_push_access_levels", ["protected_tag_id"], name: "index_protected_tag_push_access", using: :btree
+
+  create_table "protected_tags", force: :cascade do |t|
+    t.integer "project_id", null: false
+    t.string "name", null: false
+    t.string "timestamps"
+  end
+
+  add_index "protected_tags", ["project_id"], name: "index_protected_tags_on_project_id", using: :btree
+
   create_table "releases", force: :cascade do |t|
     t.string "tag"
     t.text "description"
@@ -1305,6 +1331,8 @@ ActiveRecord::Schema.define(version: 20170315194013) do
   add_foreign_key "project_statistics", "projects", on_delete: :cascade
   add_foreign_key "protected_branch_merge_access_levels", "protected_branches"
   add_foreign_key "protected_branch_push_access_levels", "protected_branches"
+  add_foreign_key "protected_tag_merge_access_levels", "protected_tags"
+  add_foreign_key "protected_tag_push_access_levels", "protected_tags"
   add_foreign_key "subscriptions", "projects", on_delete: :cascade
   add_foreign_key "timelogs", "issues", name: "fk_timelogs_issues_issue_id", on_delete: :cascade
   add_foreign_key "timelogs", "merge_requests", name: "fk_timelogs_merge_requests_merge_request_id", on_delete: :cascade