diff --git a/awx/main/conf.py b/awx/main/conf.py
index 3c3f53cadc..3aa6046ea1 100644
--- a/awx/main/conf.py
+++ b/awx/main/conf.py
@@ -410,6 +410,15 @@ register(
     category_slug='system',
 )
 
+register(
+    'PROJECT_UPDATE_VVV',
+    field_class=fields.BooleanField,
+    label=_('Run Project Updates With Higher Verbosity'),
+    help_text=_('Adds the CLI -vvv flag to ansible-playbook runs of project_update.yml used for project updates.'),
+    category=_('Jobs'),
+    category_slug='jobs',
+)
+
 register(
     'AWX_ROLES_ENABLED',
     field_class=fields.BooleanField,
@@ -430,6 +439,52 @@ register(
     category_slug='jobs',
 )
 
+register(
+    'PRIVATE_GALAXY_URL',
+    field_class=fields.URLField,
+    label=_('Private Galaxy Server Host'),
+    help_text=_('For using a private galaxy server at higher precedence than the public Ansible Galaxy. '
+                'The URL of the galaxy instance to connect to, this is required if using a private galaxy server.'),
+    category=_('Jobs'),
+    category_slug='jobs',
+)
+
+register(
+    'PRIVATE_GALAXY_USERNAME',
+    field_class=fields.CharField,
+    label=_('Private Galaxy Server Username'),
+    help_text=_('For using a private galaxy server at higher precedence than the public Ansible Galaxy. '
+                'The username to use for basic authentication against the Galaxy instance, '
+                'this is mutually exclusive with PRIVATE_GALAXY_TOKEN.'),
+    category=_('Jobs'),
+    category_slug='jobs',
+    depends_on=['PRIVATE_GALAXY_URL']
+)
+
+register(
+    'PRIVATE_GALAXY_PASSWORD',
+    field_class=fields.CharField,
+    label=_('Private Galaxy Server Password'),
+    help_text=_('For using a private galaxy server at higher precedence than the public Ansible Galaxy. '
+                'The password to use for basic authentication against the Galaxy instance, '
+                'this is mutually exclusive with PRIVATE_GALAXY_TOKEN.'),
+    category=_('Jobs'),
+    category_slug='jobs',
+    depends_on=['PRIVATE_GALAXY_URL']
+)
+
+register(
+    'PRIVATE_GALAXY_TOKEN',
+    field_class=fields.CharField,
+    label=_('Private Galaxy Server Token'),
+    help_text=_('For using a private galaxy server at higher precedence than the public Ansible Galaxy. '
+                'The username to use for basic authentication against the Galaxy instance, '
+                'this is mutually exclusive with corresponding username and password settings.'),
+    category=_('Jobs'),
+    category_slug='jobs',
+    depends_on=['PRIVATE_GALAXY_URL']
+)
+
 register(
     'STDOUT_MAX_BYTES_DISPLAY',
     field_class=fields.IntegerField,
diff --git a/awx/main/tasks.py b/awx/main/tasks.py
index ad396a45cf..f7208deb54 100644
--- a/awx/main/tasks.py
+++ b/awx/main/tasks.py
@@ -1883,6 +1883,19 @@ class RunProjectUpdate(BaseTask):
         env['TMP'] = settings.AWX_PROOT_BASE_PATH
         env['PROJECT_UPDATE_ID'] = str(project_update.pk)
         env['ANSIBLE_CALLBACK_PLUGINS'] = self.get_path_to('..', 'plugins', 'callback')
+        private_galaxy_url = settings.PRIVATE_GALAXY_URL
+        if private_galaxy_url:
+            # set up the fallback server, which is the normal Ansible Galaxy
+            env['ANSIBLE_GALAXY_SERVER_GALAXY_URL'] = 'https://galaxy.ansible.com'
+            env['ANSIBLE_GALAXY_SERVER_PRIVATE_GALAXY_URL'] = private_galaxy_url
+            for key in ('url', 'username', 'password', 'token'):
+                setting_name = 'PRIVATE_GALAXY_{}'.format(key.upper())
+                value = getattr(settings, setting_name)
+                if value:
+                    env_key = 'ANSIBLE_GALAXY_SERVER_PRIVATE_GALAXY_{}'.format(key.upper())
+                    env[env_key] = value
+            # now set the precedence
+            env['ANSIBLE_GALAXY_SERVER_LIST'] = 'private_galaxy,galaxy'
         return env
 
     def _build_scm_url_extra_vars(self, project_update):
diff --git a/awx/settings/defaults.py b/awx/settings/defaults.py
index fb24b7014f..1424850cb2 100644
--- a/awx/settings/defaults.py
+++ b/awx/settings/defaults.py
@@ -609,6 +609,9 @@ AWX_REBUILD_SMART_MEMBERSHIP = False
 # By default, allow arbitrary Jinja templating in extra_vars defined on a Job Template
 ALLOW_JINJA_IN_EXTRA_VARS = 'template'
 
+# Run project updates with extra verbosity
+PROJECT_UPDATE_VVV = False
+
 # Enable dynamically pulling roles from a requirement.yml file
 # when updating SCM projects
 # Note: This setting may be overridden by database settings.
@@ -619,6 +622,12 @@ AWX_ROLES_ENABLED = True
 # Note: This setting may be overridden by database settings.
 AWX_COLLECTIONS_ENABLED = True
 
+# Settings for private galaxy server, should be set in the UI
+PRIVATE_GALAXY_URL = None
+PRIVATE_GALAXY_USERNAME = None
+PRIVATE_GALAXY_TOKEN = None
+PRIVATE_GALAXY_PASSWORD = None
+
 # Enable bubblewrap support for running jobs (playbook runs only).
 # Note: This setting may be overridden by database settings.
 AWX_PROOT_ENABLED = True
diff --git a/awx/ui/client/src/configuration/forms/jobs-form/configuration-jobs.form.js b/awx/ui/client/src/configuration/forms/jobs-form/configuration-jobs.form.js
index 4c844a7b7d..dcf4a7f97d 100644
--- a/awx/ui/client/src/configuration/forms/jobs-form/configuration-jobs.form.js
+++ b/awx/ui/client/src/configuration/forms/jobs-form/configuration-jobs.form.js
@@ -58,12 +58,19 @@ export default ['i18n', function(i18n) {
                 type: 'text',
                 reset: 'ANSIBLE_FACT_CACHE_TIMEOUT',
             },
+            PROJECT_UPDATE_VVV: {
+                type: 'toggleSwitch',
+            },
             AWX_ROLES_ENABLED: {
                 type: 'toggleSwitch',
             },
             AWX_COLLECTIONS_ENABLED: {
                 type: 'toggleSwitch',
             },
+            PRIVATE_GALAXY_URL: {
+                type: 'text',
+                reset: 'PRIVATE_GALAXY_URL',
+            },
             AWX_TASK_ENV: {
                 type: 'textarea',
                 reset: 'AWX_TASK_ENV',