diff --git a/x/wasm/keeper/proposal_integration_test.go b/x/wasm/keeper/proposal_integration_test.go
index ca928d36fd..d36a4c5f82 100644
--- a/x/wasm/keeper/proposal_integration_test.go
+++ b/x/wasm/keeper/proposal_integration_test.go
@@ -826,3 +826,100 @@ func TestUpdateContractStatusProposals(t *testing.T) {
 		})
 	}
 }
+
+func TestUpdateInstantiateConfigProposal(t *testing.T) {
+	ctx, keepers := CreateTestInput(t, false, "staking", nil, nil)
+	govKeeper, wasmKeeper := keepers.GovKeeper, keepers.WasmKeeper
+
+	mock := wasmtesting.MockWasmer{
+		CreateFn:      wasmtesting.NoOpCreateFn,
+		AnalyzeCodeFn: wasmtesting.WithoutIBCAnalyzeFn,
+	}
+	anyAddress := sdk.BytesToAccAddress(bytes.Repeat([]byte{0x1}, types.ContractAddrLen))
+
+	withAddressAccessConfig := types.AccessTypeOnlyAddress.With(anyAddress)
+	var (
+		nobody      = StoreRandomContractWithAccessConfig(t, ctx, keepers, &mock, &types.AllowNobody)
+		everybody   = StoreRandomContractWithAccessConfig(t, ctx, keepers, &mock, &types.AllowEverybody)
+		withAddress = StoreRandomContractWithAccessConfig(t, ctx, keepers, &mock, &withAddressAccessConfig)
+	)
+	type codeUpdate struct {
+		codeID       uint64
+		AccessConfig types.AccessConfig
+	}
+	specs := map[string]struct {
+		codeUpdates []codeUpdate
+		expErr      bool
+	}{
+		"update one": {
+			codeUpdates: []codeUpdate{
+				{codeID: nobody.CodeID, AccessConfig: types.AllowEverybody},
+			},
+		},
+		"update multiple": {
+			codeUpdates: []codeUpdate{
+				{codeID: everybody.CodeID, AccessConfig: types.AllowNobody},
+				{codeID: nobody.CodeID, AccessConfig: withAddressAccessConfig},
+				{codeID: withAddress.CodeID, AccessConfig: types.AllowEverybody},
+			},
+		},
+		"update same code id": {
+			codeUpdates: []codeUpdate{
+				{codeID: everybody.CodeID, AccessConfig: types.AllowNobody},
+				{codeID: everybody.CodeID, AccessConfig: types.AllowEverybody},
+			},
+			expErr: true,
+		},
+		"update non existing code id": {
+			codeUpdates: []codeUpdate{
+				{codeID: 100, AccessConfig: types.AllowNobody},
+				{codeID: everybody.CodeID, AccessConfig: types.AllowEverybody},
+			},
+			expErr: true,
+		},
+		"update empty list": {
+			codeUpdates: make([]codeUpdate, 0),
+			expErr:      true,
+		},
+	}
+	parentCtx := ctx
+	for msg, spec := range specs {
+		t.Run(msg, func(t *testing.T) {
+
+			ctx, _ := parentCtx.CacheContext()
+
+			updates := make([]types.CodeAccessConfigUpdate, 0)
+			for _, cu := range spec.codeUpdates {
+				updates = append(updates, types.CodeAccessConfigUpdate{
+					CodeID:                cu.codeID,
+					InstantiatePermission: cu.AccessConfig,
+				})
+			}
+
+			proposal := types.UpdateInstantiateConfigProposal{
+				Title:       "Foo",
+				Description: "Bar",
+				CodeUpdates: updates,
+			}
+
+			// when stored
+			storedProposal, gotErr := govKeeper.SubmitProposal(ctx, &proposal)
+			if spec.expErr {
+				require.Error(t, gotErr)
+				return
+			}
+			require.NoError(t, gotErr)
+
+			// and proposal execute
+			handler := govKeeper.Router().GetRoute(storedProposal.ProposalRoute())
+			gotErr = handler(ctx, storedProposal.GetContent())
+			require.NoError(t, gotErr)
+
+			// then
+			for i := range spec.codeUpdates {
+				c := wasmKeeper.GetCodeInfo(ctx, spec.codeUpdates[i].codeID)
+				require.Equal(t, spec.codeUpdates[i].AccessConfig, c.InstantiateConfig)
+			}
+		})
+	}
+}
diff --git a/x/wasm/keeper/test_common.go b/x/wasm/keeper/test_common.go
index 4e6492ac1e..56e3e1fa34 100644
--- a/x/wasm/keeper/test_common.go
+++ b/x/wasm/keeper/test_common.go
@@ -593,16 +593,25 @@ func SeedNewContractInstance(t testing.TB, ctx sdk.Context, keepers TestKeepers,
 
 // StoreRandomContract sets the mock wasmerEngine in keeper and calls store
 func StoreRandomContract(t testing.TB, ctx sdk.Context, keepers TestKeepers, mock types.WasmerEngine) ExampleContract {
+	return StoreRandomContractWithAccessConfig(t, ctx, keepers, mock, nil)
+}
+
+func StoreRandomContractWithAccessConfig(
+	t testing.TB, ctx sdk.Context,
+	keepers TestKeepers,
+	mock types.WasmerEngine,
+	cfg *types.AccessConfig) ExampleContract {
 	t.Helper()
 	anyAmount := sdk.NewCoins(sdk.NewInt64Coin("denom", 1000))
 	creator, _, creatorAddr := keyPubAddr()
 	fundAccounts(t, ctx, keepers.AccountKeeper, keepers.BankKeeper, creatorAddr, anyAmount)
 	keepers.WasmKeeper.wasmVM = mock
 	wasmCode := append(wasmIdent, rand.Bytes(10)...) //nolint:gocritic
-	codeID, err := keepers.ContractKeeper.Create(ctx, creatorAddr, wasmCode, nil)
+	codeID, err := keepers.ContractKeeper.Create(ctx, creatorAddr, wasmCode, cfg)
 	require.NoError(t, err)
 	exampleContract := ExampleContract{InitialAmount: anyAmount, Creator: creator, CreatorAddr: creatorAddr, CodeID: codeID}
 	return exampleContract
+
 }
 
 type HackatomExampleInstance struct {