diff --git a/Puppetfile b/Puppetfile
--- a/Puppetfile
+++ b/Puppetfile
@@ -101,7 +101,7 @@
 
 mod 'java',
     :git => 'https://forge.softwareheritage.org/source/puppet-puppetlabs-java',
-    :tag => 'v6.0.0'
+    :tag => 'v7.3.0'
 
 mod 'java_ks',
     :git => 'https://forge.softwareheritage.org/source/puppet-puppetlabs-java_ks',
diff --git a/data/common/kafka.yaml b/data/common/kafka.yaml
--- a/data/common/kafka.yaml
+++ b/data/common/kafka.yaml
@@ -14,6 +14,7 @@
 kafka::version: '2.6.0'
 kafka::scala_version: '2.13'
 kafka::mirror_url: https://archive.apache.org/dist/
+kafka::cluster::heap_ops: "-Xmx6G -Xms6G"
 
 kafka::logdirs:
   - /srv/kafka/logdir
@@ -61,7 +62,7 @@
       # Users connecting in the plaintext endpoint are ANONYMOUS
       # TODO: remove when explicit ACLs are given to producers
       - User:ANONYMOUS
-    broker::heap_opts: "-Xmx6G -Xms6G"
+    broker::heap_opts: "%{lookup('kafka::cluster::heap_ops')}"
     tls: true
     plaintext_port: 9092
     public_tls_port: 9093
diff --git a/data/deployments/production/vagrant.yaml b/data/deployments/production/vagrant.yaml
--- a/data/deployments/production/vagrant.yaml
+++ b/data/deployments/production/vagrant.yaml
@@ -1,4 +1,4 @@
 elasticsearch::jvm_options::heap_size: 512m
 
 swh::postgresql::shared_buffers: 128MB
-swh::provenance::db::shared_buffers: 128MB
\ No newline at end of file
+swh::provenance::db::shared_buffers: 128MB
diff --git a/data/subnets/vagrant.yaml b/data/subnets/vagrant.yaml
--- a/data/subnets/vagrant.yaml
+++ b/data/subnets/vagrant.yaml
@@ -54,6 +54,7 @@
 netbox::admin::email: sysop+vagrant@softwareheritage.org
 
 kafka::cluster::public_network: 10.168.130.0/24
+kafka::cluster::heap_ops: "-Xmx512m -Xms512m"
 
 puppet::master::manage_puppetdb: true
 puppetdb::listen_address: 0.0.0.0
@@ -169,12 +170,20 @@
       - inventory.internal.softwareheritage.org
   10.168.100.201:
     host: kafka1.internal.softwareheritage.org
+    aliases:
+      - broker1.journal.softwareheritage.org
   10.168.100.202:
     host: kafka2.internal.softwareheritage.org
+    aliases:
+      - broker2.journal.softwareheritage.org
   10.168.100.203:
     host: kafka3.internal.softwareheritage.org
+    aliases:
+      - broker3.journal.softwareheritage.org
   10.168.100.204:
     host: kafka4.internal.softwareheritage.org
+    aliases:
+      - broker4.journal.softwareheritage.org
   10.168.130.11:
     host: db1.internal.staging.swh.network
   10.168.130.20: