diff --git a/manifests/os/debian.pp b/manifests/os/debian.pp
index 12e802d2d8e2bf209a2efffa284b3561410aa100..9c5e17ce212ddbe9c7ce98a05fa772dbddf5d1d2 100644
--- a/manifests/os/debian.pp
+++ b/manifests/os/debian.pp
@@ -36,11 +36,17 @@
 # regular debian repository, so some users may not want to use this extra
 # source; in that case, they should set this parameter to false.
 # Default: true
+#
+# $debian_stanford_repo_local: Include the Stanford private local (debian-local)
+# repository. Since this private repository is firewalled off from most of the internet,
+# if your service in the "cloud" you will probably want to set it to false.
+# Default: true
 
 class base::os::debian (
-  $apt_cache_notin_tmp       = false,
-  $apt_cache_tmp_dir         = '/var/cache/apt/tmp',
-  $debian_stanford_backports = true
+  $apt_cache_notin_tmp        = false,
+  $apt_cache_tmp_dir          = '/var/cache/apt/tmp',
+  $debian_stanford_backports  = true,
+  $debian_stanford_repo_local = true,
 ){
   include base::newsyslog
 
diff --git a/templates/os/sources/stanford.list.erb b/templates/os/sources/stanford.list.erb
index 57fa2958511ba438e77470ed53fac8747a9143c6..291603cad15196b2429c8fb60141f5c49dbc7115 100644
--- a/templates/os/sources/stanford.list.erb
+++ b/templates/os/sources/stanford.list.erb
@@ -20,10 +20,12 @@
 # The Stanford-specific Debian archive and source tree (world-accessible).
 deb     http://debian.stanford.edu/debian-stanford <%= dist %> main non-free contrib
 deb-src http://debian.stanford.edu/debian-stanford <%= dist %> main non-free contrib
+<% if (@debian_stanford_repo_local) -%>
 
 # The Stanford restricted Debian archive and source tree.
 deb     http://debian.stanford.edu/debian-local <%= dist %> main non-free contrib
 deb-src http://debian.stanford.edu/debian-local <%= dist %> main non-free contrib
+<% end -%>
 <% if (@debian_stanford_backports) &&
   (@lsbdistcodename == 'wheezy' || @lsbdistcodename == 'jessie' || @operatingsystem == 'Ubuntu') -%>