diff --git a/roles/koji_hub/templates/hub.conf.j2 b/roles/koji_hub/templates/hub.conf.j2
index d105cd6b35..8d5ee85b49 100644
--- a/roles/koji_hub/templates/hub.conf.j2
+++ b/roles/koji_hub/templates/hub.conf.j2
@@ -33,10 +33,10 @@ AuthKeytab = /etc/koji-hub/koji-hub.keytab
 {% if env == "staging" %}
 {% if inventory_hostname.startswith('koji') %}
 ProxyPrincipals = modularity@STG.FEDORAPROJECT.ORG,HTTP/koji.stg.fedoraproject.org@STG.FEDORAPROJECT.ORG
+{% endif %}
 {% else %}
 ProxyPrincipals = HTTP/koji.fedoraproject.org@FEDORAPROJECT.ORG|sigul/sign-bridge01.phx2.fedoraproject.org@FEDORAPROJECT.ORG
 {% endif %}
-{% endif %}
 
 ##  SSL client certificate auth configuration  ##
 #note: ssl auth may also require editing the httpd config (conf.d/kojihub.conf)