diff --git a/app/controllers/spree/admin/products_controller_decorator.rb b/app/controllers/spree/admin/products_controller_decorator.rb
index d44df1ffb5..4d18b5500a 100644
--- a/app/controllers/spree/admin/products_controller_decorator.rb
+++ b/app/controllers/spree/admin/products_controller_decorator.rb
@@ -51,6 +51,10 @@ Spree::Admin::ProductsController.class_eval do
 
   def override_variants
     @hubs = order_cycle_hub_enterprises(without_validation: true)
+
+    @hub_permissions = OpenFoodNetwork::Permissions.new(spree_current_user).
+      order_cycle_enterprises_per_hub
+
     @producers = order_cycle_producer_enterprises
   end
 
diff --git a/app/helpers/admin/injection_helper.rb b/app/helpers/admin/injection_helper.rb
index 94ee23347a..524bbb5a03 100644
--- a/app/helpers/admin/injection_helper.rb
+++ b/app/helpers/admin/injection_helper.rb
@@ -33,6 +33,10 @@ module Admin
       admin_inject_json_ams_array "ofn.admin", "producers", @producers, Api::Admin::IdNameSerializer
     end
 
+    def admin_inject_hub_permissions
+      render partial: "admin/json/injection_ams", locals: {ngModule: "ofn.admin", name: "hubPermissions", json: @hub_permissions.to_json}
+    end
+
     def admin_inject_products
       admin_inject_json_ams_array "ofn.admin", "products", @products, Spree::Api::ProductSerializer
     end
diff --git a/app/views/spree/admin/products/override_variants/_data.html.haml b/app/views/spree/admin/products/override_variants/_data.html.haml
index d96db0edb9..6d04309e4d 100644
--- a/app/views/spree/admin/products/override_variants/_data.html.haml
+++ b/app/views/spree/admin/products/override_variants/_data.html.haml
@@ -1,3 +1,4 @@
 = admin_inject_spree_api_key
 = admin_inject_hubs
+= admin_inject_hub_permissions
 = admin_inject_producers
diff --git a/lib/open_food_network/permissions.rb b/lib/open_food_network/permissions.rb
index 476db23692..86f0bf3b39 100644
--- a/lib/open_food_network/permissions.rb
+++ b/lib/open_food_network/permissions.rb
@@ -15,6 +15,16 @@ module OpenFoodNetwork
       managed_and_related_enterprises_with :add_to_order_cycle
     end
 
+    def order_cycle_enterprises_per_hub
+      Hash[
+           EnterpriseRelationship.
+           permitting(managed_enterprises).
+           with_permission(:add_to_order_cycle).
+           group_by { |er| er.child_id }.
+           map { |child_id, ers| [child_id, ers.map { |er| er.parent_id }] }
+          ]
+    end
+
     # Find the exchanges of an order cycle that an admin can manage
     def order_cycle_exchanges(order_cycle)
       enterprises = managed_enterprises + related_enterprises_with(:add_to_order_cycle)
diff --git a/spec/features/admin/override_variants_spec.rb b/spec/features/admin/override_variants_spec.rb
index 0372fed47d..1b6169a40f 100644
--- a/spec/features/admin/override_variants_spec.rb
+++ b/spec/features/admin/override_variants_spec.rb
@@ -17,6 +17,8 @@ feature %q{
 
   let!(:hub) { create(:distributor_enterprise) }
   let!(:producer) { create(:supplier_enterprise) }
+  let!(:er) { create(:enterprise_relationship, parent: producer, child: hub,
+                     permissions_list: [:add_to_order_cycle]) }
 
   describe "selecting a hub" do
     it "displays a list of hub choices" do
@@ -35,6 +37,8 @@ feature %q{
 
   context "when a hub is selected" do
     let!(:product) { create(:simple_product, supplier: producer, price: 1.23, on_hand: 12) }
+    let!(:producer2) { create(:supplier_enterprise) }
+    let!(:product2) { create(:simple_product, supplier: producer2, price: 1.23, on_hand: 12) }
 
     before do
       visit '/admin/products/override_variants'
@@ -47,6 +51,10 @@ feature %q{
       page.should have_table_row [producer.name, product.name, '1.23', '12']
     end
 
+    it "filters the products to those the hub can add to an order cycle" do
+      page.should_not have_table_row [producer2.name, product2.name, '1.23', '12']
+    end
+
     it "products values are affected by overrides"
   end
 end
diff --git a/spec/lib/open_food_network/permissions_spec.rb b/spec/lib/open_food_network/permissions_spec.rb
index bcd1f8b742..478629b822 100644
--- a/spec/lib/open_food_network/permissions_spec.rb
+++ b/spec/lib/open_food_network/permissions_spec.rb
@@ -21,6 +21,37 @@ module OpenFoodNetwork
       end
     end
 
+    describe "finding enterprises that can be added to an order cycle, for each hub" do
+      let!(:hub) { create(:distributor_enterprise) }
+      let!(:producer) { create(:supplier_enterprise) }
+      let!(:er) { create(:enterprise_relationship, parent: producer, child: hub,
+                         permissions_list: [:add_to_order_cycle]) }
+
+      before { permissions.stub(:managed_enterprises) { [hub] } }
+
+      it "returns enterprises as hub_id => [producer, ...]" do
+        permissions.order_cycle_enterprises_per_hub.should ==
+          {hub.id => [producer.id]}
+      end
+
+      it "returns only permissions relating to managed enterprises" do
+        create(:enterprise_relationship, parent: e1, child: e2,
+                         permissions_list: [:add_to_order_cycle])
+
+        permissions.order_cycle_enterprises_per_hub.should ==
+          {hub.id => [producer.id]}
+      end
+
+      it "returns only add_to_order_cycle permissions" do
+        permissions.stub(:managed_enterprises) { [hub, e2] }
+        create(:enterprise_relationship, parent: e1, child: e2,
+                         permissions_list: [:manage_products])
+
+        permissions.order_cycle_enterprises_per_hub.should ==
+          {hub.id => [producer.id]}
+      end
+    end
+
     describe "finding exchanges of an order cycle that an admin can manage" do
       let(:oc) { create(:simple_order_cycle) }
       let!(:ex) { create(:exchange, order_cycle: oc, sender: e1, receiver: e2) }