diff --git a/Changes b/Changes
index 67948479..a34760ce 100644
--- a/Changes
+++ b/Changes
@@ -1,3 +1,9 @@
+2.039006 - 2018-02-15
+
+  [BUG FIXES]
+
+  * #374 fix ACL with negation (earendilfr)
+
 2.039005 - 2018-02-15
 
   [BUG FIXES]
diff --git a/lib/App/Netdisco/Util/Permission.pm b/lib/App/Netdisco/Util/Permission.pm
index c3867cbe..5254483d 100644
--- a/lib/App/Netdisco/Util/Permission.pm
+++ b/lib/App/Netdisco/Util/Permission.pm
@@ -105,7 +105,8 @@ sub check_acl {
   my $name = undef; # only look up once, and only if qr// is used
   my $ropt = { retry => 1, retrans => 1, udp_timeout => 1, tcp_timeout => 2 };
 
-  INLIST: foreach my $item (@$config) {
+  INLIST: foreach (@$config) {
+      my $item = $_; # must copy so that we can modify safely
       next INLIST if $item eq 'op:and';
 
       if (ref qr// eq ref $item) {