diff --git a/puppet/kandra/files/nginx/sites-available/zulip b/puppet/kandra/files/nginx/sites-available/zulip
index 2a13290d81..31917499b9 100644
--- a/puppet/kandra/files/nginx/sites-available/zulip
+++ b/puppet/kandra/files/nginx/sites-available/zulip
@@ -1,3 +1,15 @@
+server {
+    # If coming from localhost, we do allow access to internal
+    # APIs over HTTP.
+    listen 127.0.0.1:80;
+    listen [::1]:80;
+
+    location /api/internal/ {
+        include /etc/nginx/zulip-include/api_headers;
+        include uwsgi_params;
+    }
+}
+
 include /etc/nginx/zulip-include/trusted-proto;
 include /etc/nginx/zulip-include/s3-cache;
 include /etc/nginx/zulip-include/upstreams;
diff --git a/puppet/kandra/files/nginx/sites-available/zulip-staging b/puppet/kandra/files/nginx/sites-available/zulip-staging
index 53db11e2de..c4d25ca67d 100644
--- a/puppet/kandra/files/nginx/sites-available/zulip-staging
+++ b/puppet/kandra/files/nginx/sites-available/zulip-staging
@@ -1,3 +1,15 @@
+server {
+    # If coming from localhost, we do allow access to internal
+    # APIs over HTTP.
+    listen 127.0.0.1:80;
+    listen [::1]:80;
+
+    location /api/internal/ {
+        include /etc/nginx/zulip-include/api_headers;
+        include uwsgi_params;
+    }
+}
+
 include /etc/nginx/zulip-include/trusted-proto;
 include /etc/nginx/zulip-include/s3-cache;
 include /etc/nginx/zulip-include/upstreams;