diff --git a/puppet/kandra/manifests/app_frontend_monitoring.pp b/puppet/kandra/manifests/app_frontend_monitoring.pp
index e4b0463685..bfc79a5319 100644
--- a/puppet/kandra/manifests/app_frontend_monitoring.pp
+++ b/puppet/kandra/manifests/app_frontend_monitoring.pp
@@ -6,6 +6,7 @@ class kandra::app_frontend_monitoring {
   include kandra::prometheus::uwsgi
   include kandra::prometheus::process
   kandra::firewall_allow { 'grok_exporter': port => '9144' }
+  kandra::firewall_allow { 'tusd': port => '9900' }
 
   file { '/etc/cron.d/rabbitmq-monitoring':
     ensure => absent,
diff --git a/puppet/zulip/manifests/app_frontend_base.pp b/puppet/zulip/manifests/app_frontend_base.pp
index ecd3a84804..4bf5a8f696 100644
--- a/puppet/zulip/manifests/app_frontend_base.pp
+++ b/puppet/zulip/manifests/app_frontend_base.pp
@@ -175,6 +175,8 @@ class zulip::app_frontend_base {
   $katex_server = zulipconf('application_server', 'katex_server', true)
   $katex_server_port = zulipconf('application_server', 'katex_server_port', '9700')
 
+  $tusd_server_listen = zulipconf('application_server', 'tusd_server_listen', '127.0.0.1')
+
   if $proxy_host != '' and $proxy_port != '' {
     $proxy = "http://${proxy_host}:${proxy_port}"
   } else {
diff --git a/puppet/zulip/templates/supervisor/zulip.conf.template.erb b/puppet/zulip/templates/supervisor/zulip.conf.template.erb
index 891fe8c246..a9b2af7991 100644
--- a/puppet/zulip/templates/supervisor/zulip.conf.template.erb
+++ b/puppet/zulip/templates/supervisor/zulip.conf.template.erb
@@ -25,7 +25,7 @@ killasgroup=true              ; Without this, we leak processes every restart
 directory=/home/zulip/deployments/current/
 
 [program:zulip-tus]
-command=nice -n5 /home/zulip/deployments/current/manage.py runtusd 9900
+command=nice -n5 /home/zulip/deployments/current/manage.py runtusd <%= @tusd_server_listen %>:9900
 environment=HTTP_proxy="<%= @proxy %>",HTTPS_proxy="<%= @proxy %>"
 priority=100                   ; the relative start priority (default 999)
 autostart=true                 ; start at supervisord start (default: true)