diff --git a/data/deployments/staging/common.yaml b/data/deployments/staging/common.yaml
--- a/data/deployments/staging/common.yaml
+++ b/data/deployments/staging/common.yaml
@@ -89,14 +89,29 @@
   rocquencourt:
     '1': journal0.internal.staging.swh.network
 
+kafka::broker::heap_opts: "-Xmx3G -Xms3G"
+
 kafka::clusters:
-  rocquencourt:
+  rocquencourt_staging:
     zookeeper::chroot: '/kafka/softwareheritage'
     zookeeper::servers:
       - journal0.internal.staging.swh.network
     brokers:
       journal0.internal.staging.swh.network:
         id: 1
+    broker::heap_opts: "%{alias('kafka::broker::heap_opts')}"
+    superusers:
+      - User:swh-admin-olasd
+      # Users connecting in the plaintext endpoint are ANONYMOUS
+      # TODO: remove when explicit ACLs are given to producers
+      - User:ANONYMOUS
+    tls: true
+    plaintext_port: 9092
+    public_tls_port: 9093
+    internal_tls_port: 9094
+    cluster_config_overrides:
+      offsets.topic.replication.factor: 1 # this is mandatory with only one node
+    # public_listener_network: 128.93.166.0/26
 
 swh::deploy::journal::brokers:
   - journal0.internal.staging.swh.network
diff --git a/data/deployments/staging/vagrant.yaml b/data/deployments/staging/vagrant.yaml
--- a/data/deployments/staging/vagrant.yaml
+++ b/data/deployments/staging/vagrant.yaml
@@ -1,2 +1,4 @@
 ---
 swh::postgresql::shared_buffers: 128MB
+
+kafka::broker::heap_opts: "-Xmx512m -Xms512m"
diff --git a/site-modules/profile/manifests/kafka/broker.pp b/site-modules/profile/manifests/kafka/broker.pp
--- a/site-modules/profile/manifests/kafka/broker.pp
+++ b/site-modules/profile/manifests/kafka/broker.pp
@@ -84,6 +84,7 @@
       target       => $ks_location,
       password     => $ks_password,
       trustcacerts => true,
+      require      => Class['Java'],
     }
 
     $plaintext_port = $kafka_cluster_config['plaintext_port']
diff --git a/site-modules/role/manifests/swh_journal_allinone.pp b/site-modules/role/manifests/swh_journal_allinone.pp
--- a/site-modules/role/manifests/swh_journal_allinone.pp
+++ b/site-modules/role/manifests/swh_journal_allinone.pp
@@ -1,3 +1,4 @@
 class role::swh_journal_allinone inherits role::swh_journal_orchestrator {
+  include profile::zookeeper
   include profile::kafka::broker
 }