diff --git a/inventory/service/group_vars/refstack-docker.yaml b/inventory/service/group_vars/refstack-docker.yaml
index c37b205704..435fac7e9b 100644
--- a/inventory/service/group_vars/refstack-docker.yaml
+++ b/inventory/service/group_vars/refstack-docker.yaml
@@ -1,2 +1,2 @@
-refstack_url: 'https://{{ ansible_fqdn }}'
+refstack_url: 'https://refstack.openstack.org'
 refstack_openid_endpoint: https://openstackid.org
diff --git a/playbooks/zuul/templates/group_vars/refstack-docker.yaml.j2 b/playbooks/zuul/templates/group_vars/refstack-docker.yaml.j2
index 7aaac590c5..fc66dcd8b5 100644
--- a/playbooks/zuul/templates/group_vars/refstack-docker.yaml.j2
+++ b/playbooks/zuul/templates/group_vars/refstack-docker.yaml.j2
@@ -1,3 +1,7 @@
+# NOTE(ianw): we set to the FQDN in the gate to avoid the
+# server trying to talk to the production CNAME; the gate testing
+# has overridden hosts for the FQDN to be localhost
+refstack_url: 'https://{{ ansible_fqdn }}'
 refstack_db_username: refstack
 refstack_db_password: Jz4ooq9TL7nc3hX3
 refstack_root_db_password: KbgY3r9HYnEYpgRP
diff --git a/zuul.d/system-config-run.yaml b/zuul.d/system-config-run.yaml
index 4cd1e16666..e8fe02b77d 100644
--- a/zuul.d/system-config-run.yaml
+++ b/zuul.d/system-config-run.yaml
@@ -912,9 +912,8 @@
       container_command: docker
     files:
       - playbooks/bridge.yaml
-      - playbooks/group_vars/refstack.yaml
-      - playbooks/host_vars/gitea.*
-      - playbooks/zuul/templates/group_vars/refstack.yaml.j2
+      - inventory/service/group-vars/refstack-docker.yaml
+      - playbooks/zuul/templates/group_vars/refstack-docker.yaml.j2
       - playbooks/roles/refstack/
       - playbooks/roles/letsencrypt-create-certs/handlers/restart_apache.yaml
       - testinfra/test_refstack.py