diff --git a/playbooks/include/proxies-fedora-web.yml b/playbooks/include/proxies-fedora-web.yml
index 50ace556d6..da9387573e 100644
--- a/playbooks/include/proxies-fedora-web.yml
+++ b/playbooks/include/proxies-fedora-web.yml
@@ -43,6 +43,9 @@
     website: budget.fedoraproject.org
   - role: fedora-web/registry
     website: registry.fedoraproject.org
+  - role: fedora-web/candidate-registry
+    website: candidate-registry.fedoraproject.org
+    when: env == "staging"
   - role: fedora-web/codecs
     website: codecs.fedoraproject.org
   - role: fedora-web/alt
diff --git a/playbooks/include/proxies-reverseproxy.yml b/playbooks/include/proxies-reverseproxy.yml
index 1eaa427635..c911b79eb3 100644
--- a/playbooks/include/proxies-reverseproxy.yml
+++ b/playbooks/include/proxies-reverseproxy.yml
@@ -501,6 +501,12 @@
     destname: registry
     proxyurl: http://localhost:10048
 
+  - role: httpd/reverseproxy
+    website: candidate-registry.fedoraproject.org
+    destname: candidate-registry
+    proxyurl: http://localhost:10048
+    when: env == "staging"
+
   - role: httpd/reverseproxy
     website: retrace.fedoraproject.org
     destname: retrace
diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml
index f671d4f8b5..b1c0f4e355 100644
--- a/playbooks/include/proxies-websites.yml
+++ b/playbooks/include/proxies-websites.yml
@@ -498,6 +498,13 @@
     sslonly: true
     cert_name: "{{wildcard_cert_name}}"
 
+  - role: httpd/website
+    name: candidate-registry.fedoraproject.org
+    server_aliases: [candidate-registry.stg.fedoraproject.org]
+    sslonly: true
+    cert_name: "{{wildcard_cert_name}}"
+    when: env == "staging"
+
   - role: httpd/website
     name: retrace.fedoraproject.org
     server_aliases: [retrace.stg.fedoraproject.org]
diff --git a/roles/haproxy/templates/haproxy.cfg b/roles/haproxy/templates/haproxy.cfg
index f17d8431a4..ef0ed3e0d8 100644
--- a/roles/haproxy/templates/haproxy.cfg
+++ b/roles/haproxy/templates/haproxy.cfg
@@ -335,6 +335,13 @@ listen  ipa 0.0.0.0:10053
     server  ipa01 ipa01:443 check inter 10s rise 1 fall 2 ssl verify required ca-file /etc/haproxy/ipa.pem
     option  httpchk GET /
 
+{% endif %}
+{% if env == "staging" %}
+
+listen docker-candidate-registry 0.0.0.0:10054
+    balance hdr(appserver)
+    server docker-candidate-registry01 docker-candidate-registry01:5000 check inter 10s rise 1 fall 2
+
 {% endif %}
 
 # Apache doesn't handle the initial connection here like the other proxy