diff --git a/config/sc-config.yaml b/config/sc-config.yaml
index 209cdde951..585c3e8912 100644
--- a/config/sc-config.yaml
+++ b/config/sc-config.yaml
@@ -147,6 +147,8 @@ grafana:
         grafanaEditor: grafana_editor  # maps to grafana role editor
         grafanaViewer: grafana_viewer  # maps to grafana role viewer
       scopes: openid profile email groups
+      useInternalDex: true
+      externalDexDomain: set-me
       allowedDomains:
         - set-me
     viewersCanEdit: true
diff --git a/helmfile.d/values/grafana/grafana-user.yaml.gotmpl b/helmfile.d/values/grafana/grafana-user.yaml.gotmpl
index 4347cb782b..20fe057cfc 100644
--- a/helmfile.d/values/grafana/grafana-user.yaml.gotmpl
+++ b/helmfile.d/values/grafana/grafana-user.yaml.gotmpl
@@ -112,9 +112,15 @@ grafana.ini:
     client_secret: $__env{clientSecret}
     use_pkce: true
     scopes: {{ .Values.grafana.user.oidc.scopes }}
+    {{- if .Values.grafana.user.oidc.useInternalDex }}
     auth_url: https://{{ .Values.dex.subdomain }}.{{ .Values.global.baseDomain }}{{ $trailingDot }}/auth
     token_url: http://dex.dex.svc.cluster.local{{ $trailingDot }}:5556/token
     api_url: http://dex.dex.svc.cluster.local{{ $trailingDot }}:5556/api
+    {{- else }}
+    auth_url: https://{{ .Values.grafana.user.oidc.externalDexDomain }}{{ $trailingDot }}/auth
+    token_url: https://{{ .Values.grafana.user.oidc.externalDexDomain }}{{ $trailingDot }}/token
+    api_url: https://{{ .Values.grafana.user.oidc.externalDexDomain }}{{ $trailingDot }}/api
+    {{- end }}
     allowed_domains: {{ join " " .Values.grafana.user.oidc.allowedDomains }}
     allow_sign_up: true
     tls_skip_verify_insecure: {{ not .Values.global.verifyTls }}