diff --git a/roles/koji_hub/templates/hub.conf.j2 b/roles/koji_hub/templates/hub.conf.j2
index faed2a3ce9..a77111af92 100644
--- a/roles/koji_hub/templates/hub.conf.j2
+++ b/roles/koji_hub/templates/hub.conf.j2
@@ -31,6 +31,12 @@ HostPrincipalFormat = compile/%s@FEDORAPROJECT.ORG
 {% endif %}
 AuthKeytab = /etc/koji-hub/koji-hub.keytab
 
+{% if env == "staging" %}
+{% if inventory_hostname.startswith('koji') %}
+ProxyPrincipals = modularity@STG.FEDORAPROJECT.ORG
+{% endif %}
+{% endif %}
+
 ##  SSL client certificate auth configuration  ##
 #note: ssl auth may also require editing the httpd config (conf.d/kojihub.conf)