diff --git a/ansible/roles/public-openrc/templates/public-openrc.sh.j2 b/ansible/roles/public-openrc/templates/public-openrc.sh.j2
index a78008871..d0356e800 100644
--- a/ansible/roles/public-openrc/templates/public-openrc.sh.j2
+++ b/ansible/roles/public-openrc/templates/public-openrc.sh.j2
@@ -5,6 +5,12 @@
 export OS_AUTH_URL={{ public_openrc_auth_url }}
 {% elif "export OS_INTERFACE" in line %}
 export OS_INTERFACE=public
+{% elif "export OS_ENDPOINT_TYPE" in line %}
+export OS_ENDPOINT_TYPE=publicURL
+{% elif "export OS_MANILA_ENDPOINT_TYPE" in line %}
+export OS_MANILA_ENDPOINT_TYPE=publicURL
+{% elif "export OS_MISTRAL_ENDPOINT_TYPE" in line %}
+export OS_MISTRAL_ENDPOINT_TYPE=publicURL
 {% elif "export OS_CACERT" in line and kolla_external_fqdn_cacert is not none %}
 export OS_CACERT={{ kolla_external_fqdn_cacert }}
 {% else %}
diff --git a/releasenotes/notes/public-os-endpoint-type-a678a8ddc51ce3b1.yaml b/releasenotes/notes/public-os-endpoint-type-a678a8ddc51ce3b1.yaml
new file mode 100644
index 000000000..737152018
--- /dev/null
+++ b/releasenotes/notes/public-os-endpoint-type-a678a8ddc51ce3b1.yaml
@@ -0,0 +1,8 @@
+---
+fixes:
+  - |
+    Changes the value of ``OS_ENDPOINT_TYPE``, ``OS_MANILA_ENDPOINT_TYPE``, and
+    ``OS_MISTRAL_ENDPOINT_TYPE`` in ``public-openrc.sh`` to use ``publicURL``,
+    which should fix issues with legacy CLI tools on hosts without access to
+    the internal API. See `story 2007950
+    <https://storyboard.openstack.org/#!/story/2007950>`__ for details.