diff --git a/data/common/common.yaml b/data/common/common.yaml
--- a/data/common/common.yaml
+++ b/data/common/common.yaml
@@ -737,6 +737,7 @@
       - deposit-rp.internal.staging.swh.network
   journal0.internal.staging.swh.network:
     domains:
+      - broker0.journal.staging.swh.network
       - journal0.internal.staging.swh.network
   stats_export:
     domains:
diff --git a/data/deployments/staging/common.yaml b/data/deployments/staging/common.yaml
--- a/data/deployments/staging/common.yaml
+++ b/data/deployments/staging/common.yaml
@@ -99,6 +99,7 @@
     brokers:
       journal0.internal.staging.swh.network:
         id: 1
+        public_hostname: broker0.journal.staging.swh.network
     broker::heap_opts: "%{alias('kafka::broker::heap_opts')}"
     superusers:
       - User:swh-admin-olasd
@@ -111,7 +112,7 @@
     internal_tls_port: 9094
     cluster_config_overrides:
       offsets.topic.replication.factor: 1 # this is mandatory with only one node
-    # public_listener_network: 128.93.166.0/26
+    public_listener_network: "%{alias('kafka::cluster::public_network')}"
 
 swh::deploy::journal::brokers:
   - journal0.internal.staging.swh.network
diff --git a/data/subnets/sesi_rocquencourt_staging.yaml b/data/subnets/sesi_rocquencourt_staging.yaml
--- a/data/subnets/sesi_rocquencourt_staging.yaml
+++ b/data/subnets/sesi_rocquencourt_staging.yaml
@@ -21,3 +21,5 @@
 internal_network: 192.168.130.0/24
 
 smtp::relay_hostname: 'smtp.inria.fr'
+
+kafka::cluster::public_network: 192.168.130.0/24
diff --git a/data/subnets/vagrant.yaml b/data/subnets/vagrant.yaml
--- a/data/subnets/vagrant.yaml
+++ b/data/subnets/vagrant.yaml
@@ -46,6 +46,8 @@
 netbox::mail::from: inventory+vagrant@softwareheritage.org
 netbox::admin::email: sysop+vagrant@softwareheritage.org
 
+kafka::cluster::public_network: 10.168.130.0/24
+
 static_hostnames:
   10.168.100.18:
     host: banco.internal.softwareheritage.org
@@ -117,6 +119,8 @@
     host: vault.internal.staging.swh.network
   10.168.130.70:
     host: journal0.internal.staging.swh.network
+    aliases:
+      - broker0.journal.staging.swh.network
   10.168.130.80:
     host: search-esnode0.internal.staging.swh.network
   10.168.130.90: