diff --git a/awx/main/conf.py b/awx/main/conf.py
index 3aa6046ea1..a4c144a351 100644
--- a/awx/main/conf.py
+++ b/awx/main/conf.py
@@ -442,47 +442,54 @@ register(
 register(
     'PRIVATE_GALAXY_URL',
     field_class=fields.URLField,
-    label=_('Private Galaxy Server Host'),
+    required=False,
+    allow_blank=True,
+    label=_('Private Galaxy Server URL'),
     help_text=_('For using a private galaxy server at higher precedence than the public Ansible Galaxy. '
                 'The URL of the galaxy instance to connect to, this is required if using a private galaxy server.'),
     category=_('Jobs'),
-    category_slug='jobs',
+    category_slug='jobs'
 )
 
 register(
     'PRIVATE_GALAXY_USERNAME',
     field_class=fields.CharField,
+    required=False,
+    allow_blank=True,
     label=_('Private Galaxy Server Username'),
     help_text=_('For using a private galaxy server at higher precedence than the public Ansible Galaxy. '
                 'The username to use for basic authentication against the Galaxy instance, '
                 'this is mutually exclusive with PRIVATE_GALAXY_TOKEN.'),
     category=_('Jobs'),
-    category_slug='jobs',
-    depends_on=['PRIVATE_GALAXY_URL']
+    category_slug='jobs'
 )
 
 register(
     'PRIVATE_GALAXY_PASSWORD',
     field_class=fields.CharField,
+    encrypted=True,
+    required=False,
+    allow_blank=True,
     label=_('Private Galaxy Server Password'),
     help_text=_('For using a private galaxy server at higher precedence than the public Ansible Galaxy. '
                 'The password to use for basic authentication against the Galaxy instance, '
                 'this is mutually exclusive with PRIVATE_GALAXY_TOKEN.'),
     category=_('Jobs'),
-    category_slug='jobs',
-    depends_on=['PRIVATE_GALAXY_URL']
+    category_slug='jobs'
 )
 
 register(
     'PRIVATE_GALAXY_TOKEN',
     field_class=fields.CharField,
+    encrypted=True,
+    required=False,
+    allow_blank=True,
     label=_('Private Galaxy Server Token'),
     help_text=_('For using a private galaxy server at higher precedence than the public Ansible Galaxy. '
-                'The username to use for basic authentication against the Galaxy instance, '
+                'The token to use for connecting with the Galaxy instance, '
                 'this is mutually exclusive with corresponding username and password settings.'),
     category=_('Jobs'),
-    category_slug='jobs',
-    depends_on=['PRIVATE_GALAXY_URL']
+    category_slug='jobs'
 )
 
 register(
diff --git a/awx/main/tasks.py b/awx/main/tasks.py
index f7208deb54..f35154be59 100644
--- a/awx/main/tasks.py
+++ b/awx/main/tasks.py
@@ -1883,11 +1883,11 @@ class RunProjectUpdate(BaseTask):
         env['TMP'] = settings.AWX_PROOT_BASE_PATH
         env['PROJECT_UPDATE_ID'] = str(project_update.pk)
         env['ANSIBLE_CALLBACK_PLUGINS'] = self.get_path_to('..', 'plugins', 'callback')
+        # If private galaxy URL is non-blank, that means this feature is enabled
         private_galaxy_url = settings.PRIVATE_GALAXY_URL
         if private_galaxy_url:
             # set up the fallback server, which is the normal Ansible Galaxy
             env['ANSIBLE_GALAXY_SERVER_GALAXY_URL'] = 'https://galaxy.ansible.com'
-            env['ANSIBLE_GALAXY_SERVER_PRIVATE_GALAXY_URL'] = private_galaxy_url
             for key in ('url', 'username', 'password', 'token'):
                 setting_name = 'PRIVATE_GALAXY_{}'.format(key.upper())
                 value = getattr(settings, setting_name)
diff --git a/awx/settings/defaults.py b/awx/settings/defaults.py
index c6bbe841e9..7adce8b8ae 100644
--- a/awx/settings/defaults.py
+++ b/awx/settings/defaults.py
@@ -623,10 +623,10 @@ AWX_ROLES_ENABLED = True
 AWX_COLLECTIONS_ENABLED = True
 
 # Settings for private galaxy server, should be set in the UI
-PRIVATE_GALAXY_URL = None
-PRIVATE_GALAXY_USERNAME = None
-PRIVATE_GALAXY_TOKEN = None
-PRIVATE_GALAXY_PASSWORD = None
+PRIVATE_GALAXY_URL = ''
+PRIVATE_GALAXY_USERNAME = ''
+PRIVATE_GALAXY_TOKEN = ''
+PRIVATE_GALAXY_PASSWORD = ''
 # Public Galaxy URL, not configurable outside of file-based settings
 PUBLIC_GALAXY_URL = 'https://galaxy.ansible.com'
 
diff --git a/awx/ui/client/src/configuration/forms/jobs-form/configuration-jobs.form.js b/awx/ui/client/src/configuration/forms/jobs-form/configuration-jobs.form.js
index dcf4a7f97d..4736c10de9 100644
--- a/awx/ui/client/src/configuration/forms/jobs-form/configuration-jobs.form.js
+++ b/awx/ui/client/src/configuration/forms/jobs-form/configuration-jobs.form.js
@@ -71,6 +71,20 @@ export default ['i18n', function(i18n) {
                 type: 'text',
                 reset: 'PRIVATE_GALAXY_URL',
             },
+            PRIVATE_GALAXY_USERNAME: {
+                type: 'text',
+                reset: 'PRIVATE_GALAXY_USERNAME',
+            },
+            PRIVATE_GALAXY_PASSWORD: {
+                type: 'sensitive',
+                hasShowInputButton: true,
+                reset: 'PRIVATE_GALAXY_PASSWORD',
+            },
+            PRIVATE_GALAXY_TOKEN: {
+                type: 'sensitive',
+                hasShowInputButton: true,
+                reset: 'PRIVATE_GALAXY_TOKEN',
+            },
             AWX_TASK_ENV: {
                 type: 'textarea',
                 reset: 'AWX_TASK_ENV',