diff --git a/data/common/common.yaml b/data/common/common.yaml
--- a/data/common/common.yaml
+++ b/data/common/common.yaml
@@ -1704,6 +1704,7 @@
 # aliases are pulled from letsencrypt::certificates[$swh::deploy::deposit::vhost::letsencrypt_cert]
 swh::deploy::deposit::vhost::letsencrypt_cert: deposit_production
 swh::deploy::deposit::url: https://deposit.softwareheritage.org
+swh::deploy::deposit::internal_url: "%{hiera('swh::deploy::deposit::url')}"
 swh::deploy::deposit::vhost::ssl_protocol: "%{hiera('apache::ssl_protocol')}"
 swh::deploy::deposit::vhost::ssl_honorcipherorder: "%{hiera('apache::ssl_honorcipherorder')}"
 swh::deploy::deposit::vhost::ssl_cipher: "%{hiera('apache::ssl_cipher')}"
@@ -1789,7 +1790,7 @@
     task_queues:
       - swh.deposit.loader.tasks.ChecksDepositTsk
   deposit:
-    url: "%{hiera('swh::deploy::deposit::url')}/1/private/"
+    url: "%{hiera('swh::deploy::deposit::internal_url')}/1/private/"
     auth:
       username: "%{hiera('deposit_basic_auth_swhworker_username')}"
       password: "%{hiera('deposit_basic_auth_swhworker_password')}"
@@ -1864,7 +1865,7 @@
 swh::deploy::webapp::config::es_workers_index_url: http://esnode1.internal.softwareheritage.org:9200/swh_workers-*
 swh::deploy::webapp::production_db_dir: /var/lib/swh
 swh::deploy::webapp::production_db: "%{hiera('swh::deploy::webapp::production_db_dir')}/web.sqlite3"
-swh::deploy::webapp::deposit::private::url: "%{hiera('swh::deploy::deposit::url')}/1/private/"
+swh::deploy::webapp::deposit::private::url: "%{hiera('swh::deploy::deposit::internal_url')}/1/private/"
 swh::deploy::webapp::config::throttling:
   cache_uri: "%{hiera('memcached::server::bind')}:%{hiera('memcached::server::port')}"
   scopes:
diff --git a/data/deployments/staging/common.yaml b/data/deployments/staging/common.yaml
--- a/data/deployments/staging/common.yaml
+++ b/data/deployments/staging/common.yaml
@@ -78,7 +78,8 @@
 swh::remote_service::scheduler::config: "%{alias('swh::remote_service::scheduler::config::scheduler0')}"
 swh::remote_service::scheduler::config::writable: "%{alias('swh::remote_service::scheduler::config::scheduler0')}"
 
-swh::deploy::deposit::url: http://deposit.internal.staging.swh.network
+swh::deploy::deposit::url: https://deposit.staging.swh.network
+swh::deploy::deposit::internal_url: "https://deposit-rp.internal.staging.swh.network"
 
 # do not save pack
 swh::deploy::worker::loader_git::save_data_path: ""