diff --git a/.changeset/loud-snails-sleep.md b/.changeset/loud-snails-sleep.md
new file mode 100644
index 0000000000..a34388e5aa
--- /dev/null
+++ b/.changeset/loud-snails-sleep.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-vault-backend': patch
+---
+
+Added (optional) publicUrl to editUrl and showUrl in case baseUrl is an internal url
diff --git a/plugins/vault-backend/README.md b/plugins/vault-backend/README.md
index d7d227607d..c1b49f623a 100644
--- a/plugins/vault-backend/README.md
+++ b/plugins/vault-backend/README.md
@@ -63,7 +63,8 @@ To get started, first you need a running instance of Vault. You can follow [this
 
    ```yaml
    vault:
-     baseUrl: http://your-vault-url
+     baseUrl: http://your-internal-vault-url.svc
+     publicUrl: https://your-vault-url.example.com
      token: <VAULT_TOKEN>
      secretEngine: 'customSecretEngine' # Optional. By default it uses 'secrets'
      kvVersion: <kv-version> # Optional. The K/V version that your instance is using. The available options are '1' or '2'
diff --git a/plugins/vault-backend/config.d.ts b/plugins/vault-backend/config.d.ts
index c7aac4db9d..a30999b0cb 100644
--- a/plugins/vault-backend/config.d.ts
+++ b/plugins/vault-backend/config.d.ts
@@ -23,6 +23,12 @@ export interface Config {
      */
     baseUrl: string;
 
+    /**
+     * The publicUrl for your Vault instance (Optional).
+     * @visibility frontend
+     */
+    publicUrl?: string;
+
     /**
      * The token used by Backstage to access Vault.
      * @visibility secret
diff --git a/plugins/vault-backend/src/config/config.ts b/plugins/vault-backend/src/config/config.ts
index 4920c73fed..9eed497a48 100644
--- a/plugins/vault-backend/src/config/config.ts
+++ b/plugins/vault-backend/src/config/config.ts
@@ -27,6 +27,11 @@ export interface VaultConfig {
    */
   baseUrl: string;
 
+  /**
+   * The publicUrl for your Vault instance (Optional).
+   */
+  publicUrl?: string;
+
   /**
    * The token used by Backstage to access Vault.
    */
diff --git a/plugins/vault-backend/src/service/vaultApi.ts b/plugins/vault-backend/src/service/vaultApi.ts
index ea588964dc..7510ff218e 100644
--- a/plugins/vault-backend/src/service/vaultApi.ts
+++ b/plugins/vault-backend/src/service/vaultApi.ts
@@ -135,11 +135,13 @@ export class VaultClient implements VaultApi {
             )),
           );
         } else {
+          const vaultUrl =
+            this.vaultConfig.publicUrl || this.vaultConfig.baseUrl;
           secrets.push({
             name: secret,
             path: secretPath,
-            editUrl: `${this.vaultConfig.baseUrl}/ui/vault/secrets/${this.vaultConfig.secretEngine}/edit/${secretPath}/${secret}`,
-            showUrl: `${this.vaultConfig.baseUrl}/ui/vault/secrets/${this.vaultConfig.secretEngine}/show/${secretPath}/${secret}`,
+            editUrl: `${vaultUrl}/ui/vault/secrets/${this.vaultConfig.secretEngine}/edit/${secretPath}/${secret}`,
+            showUrl: `${vaultUrl}/ui/vault/secrets/${this.vaultConfig.secretEngine}/show/${secretPath}/${secret}`,
           });
         }
       }),