diff --git a/internal/api/controller/repo/controller.go b/internal/api/controller/repo/controller.go
index d7f190ff3..5f9b8f63f 100644
--- a/internal/api/controller/repo/controller.go
+++ b/internal/api/controller/repo/controller.go
@@ -66,7 +66,7 @@ func CreateRPCWriteParams(ctx context.Context, urlProvider *url.Provider,
 
 	// generate envars (add everything githook CLI needs for execution)
 	envVars, err := githook.GenerateEnvironmentVariables(&githook.Payload{
-		BaseURL:     urlProvider.GetAPIBaseURL(),
+		BaseURL:     urlProvider.GetAPIBaseURLInternal(),
 		RepoID:      repo.ID,
 		PrincipalID: session.Principal.ID,
 		RequestID:   requestID,
diff --git a/internal/url/provider.go b/internal/url/provider.go
index 1055836b7..b9858d4f1 100644
--- a/internal/url/provider.go
+++ b/internal/url/provider.go
@@ -13,32 +13,41 @@ import (
 
 // Provider provides the URLs of the gitness system.
 type Provider struct {
-	// apiURLRaw stores the raw URL the api endpoints are available at.
+	// apiURLRaw stores the raw URL the api endpoints are reachable at publicly.
 	apiURLRaw string
+	// apiURLInternalRaw stores the raw URL the api endpoints are reachable at internally.
+	// NOTE: no need for internal services to go via public route.
+	apiURLInternalRaw string
 
 	// gitURL stores the URL the git endpoints are available at.
 	// NOTE: we store it as url.URL so we can derive clone URLS without errors.
 	gitURL *url.URL
 }
 
-func NewProvider(apiURLRaw string, rawGitURL string) (*Provider, error) {
-	gitURL, err := url.Parse(rawGitURL)
+func NewProvider(apiURLRaw string, apiURLInternalRaw, gitURLRaw string) (*Provider, error) {
+	gitURL, err := url.Parse(gitURLRaw)
 	if err != nil {
-		return nil, fmt.Errorf("provided rawGitURL '%s' is invalid: %w", rawGitURL, err)
+		return nil, fmt.Errorf("provided gitURLRaw '%s' is invalid: %w", gitURLRaw, err)
 	}
 
 	return &Provider{
-		apiURLRaw: apiURLRaw,
-		gitURL:    gitURL,
+		apiURLRaw:         apiURLRaw,
+		apiURLInternalRaw: apiURLInternalRaw,
+		gitURL:            gitURL,
 	}, nil
 }
 
-// GetAPIBaseURL returns the base url of the api server.
+// GetAPIBaseURL returns the publicly reachable base url of the api server.
 func (p *Provider) GetAPIBaseURL() string {
 	return p.apiURLRaw
 }
 
-// GenerateRepoCloneURL generates the git clone URL for the provided repo path.
+// GetAPIBaseURLInternal returns the internally reachable base url of the api server.
+func (p *Provider) GetAPIBaseURLInternal() string {
+	return p.apiURLInternalRaw
+}
+
+// GenerateRepoCloneURL generates the public git clone URL for the provided repo path.
 func (p *Provider) GenerateRepoCloneURL(repoPath string) string {
 	repoPath = path.Clean(repoPath)
 	if !strings.HasSuffix(repoPath, ".git") {
diff --git a/internal/url/wire.go b/internal/url/wire.go
index 81d5d739d..a532633cc 100644
--- a/internal/url/wire.go
+++ b/internal/url/wire.go
@@ -16,6 +16,7 @@ var WireSet = wire.NewSet(ProvideURLProvider)
 func ProvideURLProvider(config *types.Config) (*Provider, error) {
 	return NewProvider(
 		config.URL.API,
+		config.URL.APIInternal,
 		config.URL.Git,
 	)
 }
diff --git a/types/config.go b/types/config.go
index c5b3a305a..730d4037b 100644
--- a/types/config.go
+++ b/types/config.go
@@ -18,8 +18,9 @@ type Config struct {
 
 	// URL defines the URLs via which the different parts of the service are reachable by.
 	URL struct {
-		Git string `envconfig:"GITNESS_URL_GIT" default:"http://localhost:3000"`
-		API string `envconfig:"GITNESS_URL_API" default:"http://localhost:3000"`
+		Git         string `envconfig:"GITNESS_URL_GIT" default:"http://localhost:3000"`
+		API         string `envconfig:"GITNESS_URL_API" default:"http://localhost:3000"`
+		APIInternal string `envconfig:"GITNESS_URL_API_INTERNAL" default:"http://localhost:3000"`
 	}
 
 	// Git defines the git configuration parameters