diff --git a/desk/app/storage.hoon b/desk/app/storage.hoon
index 487f0b4c..dd246516 100644
--- a/desk/app/storage.hoon
+++ b/desk/app/storage.hoon
@@ -11,14 +11,16 @@
   $%  state-zero
       state-one
       state-two
+      state-three
   ==
 ::
-+$  state-zero  [%0 =credentials:zero:past =configuration:zero:past]
-+$  state-one   [%1 =credentials:one:past =configuration:one:past]
-+$  state-two   [%2 =credentials =configuration]
++$  state-zero    [%0 =credentials:zero:past =configuration:zero:past]
++$  state-one     [%1 =credentials:one:past =configuration:one:past]
++$  state-two     [%2 =credentials:two:past =configuration:two:past]
++$  state-three   [%3 =credentials =configuration]
 --
 ::
-=|  state-two
+=|  state-three
 =*  state  -
 ::
 %-  agent:dbug
@@ -49,9 +51,10 @@
   =/  old  u.old
   |-
   ?-  -.old
-    %0  $(old (state-0-to-1 old))
+    %3  `this(state old)
+    %2  $(old (state-2-to-3 old))
     %1  $(old (state-1-to-2 old))
-    %2  `this(state old)
+    %0  $(old (state-0-to-1 old))
   ==
   ++  state-0-to-1
     |=  zer=state-zero
@@ -79,13 +82,30 @@
   ::
   ++  configuration-1-to-2
     |=  conf=configuration:one:past
-    ^-  ^configuration
+    ^-  configuration:two:past
     :*  buckets.conf
         current-bucket.conf
         region.conf
         ''
         %credentials
     ==
+  ++  state-2-to-3
+    |=  two=state-two
+    ^-  state-three
+    :*  %3
+        credentials.two
+        (configuration-2-to-3 configuration.two)
+    ==
+  ++  configuration-2-to-3
+    |=  conf=configuration:two:past
+    ^-  ^configuration
+    :*  buckets.conf
+        current-bucket.conf
+        region.conf
+        presigned-url.conf
+        service.conf
+        ''
+    ==
   --
 ::
 ++  on-poke
@@ -138,6 +158,9 @@
     ::
         %set-region
       state(region.configuration region.act)
+    ::
+        %set-public-url-base
+      state(public-url-base.configuration public-url-base.act)
     ::
         %set-current-bucket
       %_  state
diff --git a/desk/lib/storage-json.hoon b/desk/lib/storage-json.hoon
index 8f887214..53115cab 100644
--- a/desk/lib/storage-json.hoon
+++ b/desk/lib/storage-json.hoon
@@ -11,6 +11,7 @@
         [%set-access-key-id so:dejs]
         [%set-secret-access-key so:dejs]
         [%set-region so:dejs]
+        [%set-public-url-base so:dejs]
         [%add-bucket so:dejs]
         [%remove-bucket so:dejs]
         [%set-current-bucket so:dejs]
@@ -26,14 +27,15 @@
   %+  frond:enjs  %storage-update
   %-  pairs:enjs
   :~  ?-  -.upd
-          %set-current-bucket  [%'setCurrentBucket' s+bucket.upd]
-          %add-bucket          [%'addBucket' s+bucket.upd]
-          %set-region          [%'setRegion' s+region.upd]
-          %remove-bucket       [%'removeBucket' s+bucket.upd]
-          %set-endpoint        [%'setEndpoint' s+endpoint.upd]
-          %set-access-key-id   [%'setAccessKeyId' s+access-key-id.upd]
-          %set-presigned-url   [%'setPresignedUrl' s+url.upd]
-          %toggle-service      [%'toggleService' s+service.upd]
+          %set-current-bucket   [%'setCurrentBucket' s+bucket.upd]
+          %add-bucket           [%'addBucket' s+bucket.upd]
+          %set-region           [%'setRegion' s+region.upd]
+          %set-public-url-base  [%'setPublicUrlBase' s+public-url-base.upd]
+          %remove-bucket        [%'removeBucket' s+bucket.upd]
+          %set-endpoint         [%'setEndpoint' s+endpoint.upd]
+          %set-access-key-id    [%'setAccessKeyId' s+access-key-id.upd]
+          %set-presigned-url    [%'setPresignedUrl' s+url.upd]
+          %toggle-service       [%'toggleService' s+service.upd]
           %set-secret-access-key
         [%'setSecretAccessKey' s+secret-access-key.upd]
       ::
@@ -51,6 +53,7 @@
         :~  [%buckets a+(turn ~(tap in buckets.configuration.upd) |=(a=@t s+a))]
             [%'currentBucket' s+current-bucket.configuration.upd]
             [%'region' s+region.configuration.upd]
+            [%'publicUrlBase' s+public-url-base.configuration.upd]
             [%'service' s+service.configuration.upd]
             [%'presignedUrl' s+presigned-url.configuration.upd]
         ==
diff --git a/desk/sur/storage-2.hoon b/desk/sur/storage-2.hoon
new file mode 100644
index 00000000..9e75d027
--- /dev/null
+++ b/desk/sur/storage-2.hoon
@@ -0,0 +1,42 @@
+|%
++$  service  ?(%presigned-url %credentials)
++$  credentials
+  $:  endpoint=@t
+      access-key-id=@t
+      secret-access-key=@t
+  ==
+::
+::  $configuration: the upload configuration
+::
+::    $buckets: the buckets available
+::    $current-bucket: the current bucket we use to upload
+::    $region: the region of the current bucket
+::    $presigned-url: the presigned url endpoint
+::    $service: whether to use a presigned url service or direct S3 uploads
+::
++$  configuration
+  $:  buckets=(set @t)
+      current-bucket=@t
+      region=@t
+      presigned-url=@t
+      =service
+  ==
+::
++$  action
+  $%  [%set-endpoint endpoint=@t]
+      [%set-access-key-id access-key-id=@t]
+      [%set-secret-access-key secret-access-key=@t]
+      [%add-bucket bucket=@t]
+      [%remove-bucket bucket=@t]
+      [%set-current-bucket bucket=@t]
+      [%set-region region=@t]
+      [%set-presigned-url url=@t]
+      [%toggle-service =service]
+  ==
+::
++$  update
+  $%  [%credentials =credentials]
+      [%configuration =configuration]
+      action
+  ==
+--
diff --git a/desk/sur/storage.hoon b/desk/sur/storage.hoon
index 6a8387c8..3808310e 100644
--- a/desk/sur/storage.hoon
+++ b/desk/sur/storage.hoon
@@ -1,9 +1,10 @@
-/-  zer=storage-0, uno=storage-1
+/-  zer=storage-0, uno=storage-1, dos=storage-2
 |%
 ++  past
   |%
   ++  zero  zer
   ++  one   uno
+  ++  two   dos
   --
 +$  service  ?(%presigned-url %credentials)
 +$  credentials
@@ -19,6 +20,7 @@
 ::    $region: the region of the current bucket
 ::    $presigned-url: the presigned url endpoint
 ::    $service: whether to use a presigned url service or direct S3 uploads
+::    $public-url-base: URL base to substitute into returned object URLs
 ::
 +$  configuration
   $:  buckets=(set @t)
@@ -26,6 +28,7 @@
       region=@t
       presigned-url=@t
       =service
+      public-url-base=@t
   ==
 ::
 +$  action
@@ -36,6 +39,7 @@
       [%remove-bucket bucket=@t]
       [%set-current-bucket bucket=@t]
       [%set-region region=@t]
+      [%set-public-url-base public-url-base=@t]
       [%set-presigned-url url=@t]
       [%toggle-service =service]
   ==
diff --git a/ui/src/gear/storage/lib.ts b/ui/src/gear/storage/lib.ts
index 3a6337df..a81b8465 100644
--- a/ui/src/gear/storage/lib.ts
+++ b/ui/src/gear/storage/lib.ts
@@ -8,6 +8,7 @@ import {
   StorageUpdateAccessKeyId,
   StorageUpdateSecretAccessKey,
   StorageUpdateRegion,
+  StorageUpdatePublicUrlBase,
   StorageService,
   StorageUpdateSetPresignedUrl,
   StorageUpdateToggleService,
@@ -60,6 +61,13 @@ export const setRegion = (region: string): Poke<StorageUpdateRegion> =>
     'set-region': region,
   });
 
+export const setPublicUrlBase = (
+  publicUrlBase: string
+): Poke<StorageUpdatePublicUrlBase> =>
+  storageAction({
+    'set-public-url-base': publicUrlBase,
+  });
+
 export const setPresignedUrl = (
   presignedUrl: string
 ): Poke<StorageUpdateSetPresignedUrl> =>
diff --git a/ui/src/gear/storage/types.ts b/ui/src/gear/storage/types.ts
index 7887edb8..d62f8d79 100644
--- a/ui/src/gear/storage/types.ts
+++ b/ui/src/gear/storage/types.ts
@@ -8,6 +8,7 @@ export interface StorageConfiguration {
   buckets: Set<string>;
   currentBucket: string;
   region: string;
+  publicUrlBase: string;
   presignedUrl: string;
   service: StorageService;
 }
@@ -135,6 +136,10 @@ export interface StorageUpdateRegion {
   setRegion: string;
 }
 
+export interface StorageUpdatePublicUrlBase {
+  setPublicUrlBase: string;
+}
+
 export interface StorageUpdateToggleService {
   toggleService: string;
 }
@@ -153,5 +158,6 @@ export declare type StorageUpdate =
   | StorageUpdateAccessKeyId
   | StorageUpdateSecretAccessKey
   | StorageUpdateRegion
+  | StorageUpdatePublicUrlBase
   | StorageUpdateToggleService
   | StorageUpdateSetPresignedUrl;
diff --git a/ui/src/preferences/StoragePrefs.tsx b/ui/src/preferences/StoragePrefs.tsx
index 2b5c8088..a6affa4f 100644
--- a/ui/src/preferences/StoragePrefs.tsx
+++ b/ui/src/preferences/StoragePrefs.tsx
@@ -20,11 +20,13 @@ interface CredentialsSubmit {
   accessId: string;
   accessSecret: string;
   region: string;
+  publicUrlBase: string;
   bucket: string;
 }
 
 type S3Update =
   | { 'set-region': string }
+  | { 'set-public-url-base': string }
   | { 'set-endpoint': string }
   | { 'set-access-key-id': string }
   | { 'set-secret-access-key': string }
@@ -60,6 +62,7 @@ export const StoragePrefs = () => {
       api.poke(storagePoke({ 'set-secret-access-key': data.accessSecret }));
       api.poke(storagePoke({ 'set-current-bucket': data.bucket }));
       api.poke(storagePoke({ 'set-region': data.region }));
+      api.poke(storagePoke({ 'set-public-url-base': data.publicUrlBase }));
     }, [])
   );
 
@@ -207,6 +210,23 @@ export const StoragePrefs = () => {
                   {!loaded && <Spinner className="absolute top-1 right-2" />}
                 </div>
               </div>
+              <div className="mb-8 flex flex-col space-y-2">
+                <label className="font-semibold" htmlFor="publicUrlBase">
+                  Public URL base (normally unnecessary)
+                </label>
+                <div className="relative">
+                  <input
+                    disabled={!loaded}
+                    id="publicUrlBase"
+                    type="text"
+                    autoCorrect="off"
+                    defaultValue={s3.configuration?.publicUrlBase}
+                    {...register('publicUrlBase')}
+                    className="input default-ring bg-gray-50"
+                  />
+                  {!loaded && <Spinner className="absolute top-1 right-2" />}
+                </div>
+              </div>
               <div className="mb-8 flex flex-col space-y-2">
                 <label className="font-semibold" htmlFor="bucket">
                   Bucket Name<span title="Required field">*</span>
diff --git a/ui/src/state/storage/reducer.ts b/ui/src/state/storage/reducer.ts
index 6620199a..dc2c01ed 100644
--- a/ui/src/state/storage/reducer.ts
+++ b/ui/src/state/storage/reducer.ts
@@ -28,6 +28,7 @@ const configuration = (
       buckets: new Set(data.buckets),
       currentBucket: data.currentBucket,
       region: data.region,
+      publicUrlBase: data.publicUrlBase,
       // if landscape is not up to date we need to default these so the
       // client init logic still works
       presignedUrl: data.presignedUrl || hostingUploadURL,
@@ -105,6 +106,16 @@ const region = (json: StorageUpdate, state: StorageState): StorageState => {
   return state;
 };
 
+const publicUrlBase = (
+  json: StorageUpdate, state: StorageState
+): StorageState => {
+  const data = _.get(json, 'setPublicUrlBase', false);
+  if (data && state.s3.configuration) {
+    state.s3.configuration.publicUrlBase = data;
+  }
+  return state;
+};
+
 const presignedUrl = (
   json: StorageUpdate,
   state: StorageState
@@ -137,6 +148,7 @@ const reduce = [
   accessKeyId,
   secretAccessKey,
   region,
+  publicUrlBase,
   presignedUrl,
   toggleService,
 ];
diff --git a/ui/src/state/storage/storage.ts b/ui/src/state/storage/storage.ts
index 0f762815..1f4278cd 100644
--- a/ui/src/state/storage/storage.ts
+++ b/ui/src/state/storage/storage.ts
@@ -26,6 +26,7 @@ export const useStorage = createState<BaseStorageState>(
         buckets: new Set(),
         currentBucket: '',
         region: '',
+        publicUrlBase: '',
         presignedUrl: hostingUploadURL,
         service: 'credentials',
       },
diff --git a/ui/src/state/storage/upload.ts b/ui/src/state/storage/upload.ts
index 75d655a0..99200988 100644
--- a/ui/src/state/storage/upload.ts
+++ b/ui/src/state/storage/upload.ts
@@ -145,17 +145,18 @@ export const useFileStore = create<FileStore>((set, get) => ({
         ACL: 'public-read',
       });
 
-      const url = await getSignedUrl(client, command);
+      const url = config.publicUrlBase
+        ? new URL(key, config.publicUrlBase).toString()
+        : await getSignedUrl(client, command).then((res) => res.split('?')[0]);
 
       client
         .send(command)
         .then(() => {
-          const fileUrl = url.split('?')[0];
           updateStatus(uploader, key, 'success');
-          imageSize(fileUrl).then((s) =>
+          imageSize(url).then((s) =>
             updateFile(uploader, key, {
               size: s,
-              url: fileUrl,
+              url,
             })
           );
         })