--- a/hghooks/mozhghooks/prevent_string_changes.py
+++ b/hghooks/mozhghooks/prevent_string_changes.py
@@ -11,18 +11,19 @@
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 """
 This hook is to prevent changes to strings in string frozen branches without
-explicit approval from l10n-drivers. Can be bypassed adding L10NOK to the
-commit message (case sensitive), see bug 859358 for further details.
+explicit approval from l10n-drivers. Can be bypassed adding l10n= followed by
+an approver to the commit message (case sensitive), see bug 859358 for further
+details.
 """
 
 import re
 
 
 def hook(ui, repo, hooktype, node, source=None, **kwargs):
     if source in ('pull', 'strip'):
         return 0

new file mode 100644
--- /dev/null
+++ b/hghooks/mozhghooks/verify-css-image-only-approvals.py
@@ -0,0 +1,52 @@
+#!/usr/bin/env python
+# Copyright (C) 2014 Mozilla Foundation
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+"""
+This hook checks that people using a=css-image-only are in fact only touching
+such files (ie CSS/images/jar.mn).
+"""
+
+
+def hook(ui, repo, hooktype, node, source=None, **kwargs):
+    if source in ('pull', 'strip'):
+        return 0
+
+    if 'a=css-image-only' not in repo['tip'].description().lower():
+        # We only care if the 'css-image-only' approval message was used
+        return 0
+
+    errors = []
+    # Loop through each changeset being added to the repository
+    for change_id in xrange(repo[node].rev(), len(repo)):
+        # Loop through each file for the current changeset
+        for changed_file in repo[change_id].files():
+            # Check they have an expected extension:
+            if not changed_file.endswith(('.css', 'jar.mn', '.png', '.jpg', '.svg')):
+                errors.append('* non-image/css-file (%s) altered in this changeset\n' % changed_file)
+
+    if len(errors) > 0:
+        print('\n************************** ERROR ****************************')
+        print('\n'.join(errors))
+        print('You used the a=css-image-only approval message, but your change')
+        print('included non-CSS/image/jar.mn changes. Please get "normal"')
+        print('approval from release management for your changes.')
+        print('*************************************************************\n')
+        # Reject changes
+        return 1
+    print('Thanks for your a=css-image-only push, it\'s the best!')
+
+    # Otherwise, accept changes
+    return 0

new file mode 100644
--- /dev/null
+++ b/hghooks/tests/test-css-image-only-changes.t
@@ -0,0 +1,142 @@
+  $ hg init server
+  $ cat >> server/.hg/hgrc << EOF
+  > [hooks]
+  > pretxnchangegroup.verify-css-image-only-approvals = python:mozhghooks.verify-css-image-only-approvals.hook
+  > pretxnchangegroup.treeclosure = python:mozhghooks.treeclosure.hook
+  > 
+  > [extensions]
+  > urlintercept = $TESTDIR/testing/url-intercept.py
+  > 
+  > [urlintercept]
+  > path = $TESTTMP/url
+  > EOF
+
+Mark the tree here as approval-required
+
+  $ cat > $TESTTMP/url << EOF
+  > https://api.pub.build.mozilla.org/treestatus/trees/server
+  > {"result": {"status": "approval required", "reason": "be verrrry careful"}}
+  > EOF
+
+
+Add file (tracked extension), no approval flag, should not work because approval is required
+
+  $ hg init client
+  $ cd client
+  $ echo "Some SVG" >> test.svg
+  $ hg commit -A -m "Change SVG without any approval"
+  adding test.svg
+  $ hg push ../server
+  pushing to ../server
+  searching for changes
+  adding changesets
+  adding manifests
+  adding file changes
+  added 1 changesets with 1 changes to 1 files
+  intercepting url
+  
+  
+  ************************** ERROR ****************************
+  Pushing to an APPROVAL REQUIRED tree requires your top changeset comment to include: a=... (or, more accurately, a\S*=...)
+  *************************************************************
+  
+  
+  transaction abort!
+  rollback completed
+  abort: pretxnchangegroup.treeclosure hook failed
+  [255]
+
+
+
+Add file (untracked extension), no approval flag, should not work because approval is required
+
+  $ echo "Something else" >> test.txt
+  $ hg commit -A -m "Change other file without any approval"
+  adding test.txt
+  $ hg push ../server
+  pushing to ../server
+  searching for changes
+  adding changesets
+  adding manifests
+  adding file changes
+  added 2 changesets with 2 changes to 2 files
+  intercepting url
+  
+  
+  ************************** ERROR ****************************
+  Pushing to an APPROVAL REQUIRED tree requires your top changeset comment to include: a=... (or, more accurately, a\S*=...)
+  *************************************************************
+  
+  
+  transaction abort!
+  rollback completed
+  abort: pretxnchangegroup.treeclosure hook failed
+  [255]
+
+
+
+Tidy up the previous commits
+Hook shouldn't run when stripping:
+  $ cat >> .hg/hgrc << EOF
+  > [extensions]
+  > strip =
+  > 
+  > EOF
+  $ hg strip -r 0:1 --no-backup
+  0 files updated, 0 files merged, 2 files removed, 0 files unresolved
+  $ hg parent --template '{rev}\n'
+
+
+Add file (tracked extension), approval flag, should work
+
+  $ echo "Some more SVG" >> test.svg
+  $ hg commit -A -m "Change SVG with a=css-image-only"
+  adding test.svg
+  $ hg push ../server
+  pushing to ../server
+  searching for changes
+  adding changesets
+  adding manifests
+  adding file changes
+  added 1 changesets with 1 changes to 1 files
+  Thanks for your a=css-image-only push, it's the best!
+  intercepting url
+
+Add file (untracked extension), approval flag, should fail
+
+  $ echo "Some other things" >> test.txt
+  $ hg commit -A -m "Change non-SVG with a=css-image-only"
+  adding test.txt
+  $ hg push ../server
+  pushing to ../server
+  searching for changes
+  adding changesets
+  adding manifests
+  adding file changes
+  added 1 changesets with 1 changes to 1 files
+  
+  ************************** ERROR ****************************
+  * non-image/css-file (test.txt) altered in this changeset
+  
+  You used the a=css-image-only approval message, but your change
+  included non-CSS/image/jar.mn changes. Please get "normal"
+  approval from release management for your changes.
+  *************************************************************
+  
+  transaction abort!
+  rollback completed
+  abort: pretxnchangegroup.verify-css-image-only-approvals hook failed
+  [255]
+
+Add file (untracked extension), generic approval flag, should work
+  $ echo "Some other things" >> test.txt
+  $ hg commit -A -m "Change non-SVG with a=actual-approval"
+  $ hg push ../server
+  pushing to ../server
+  searching for changes
+  adding changesets
+  adding manifests
+  adding file changes
+  added 2 changesets with 2 changes to 1 files
+  intercepting url
+