diff --git a/templates/zuul.vhost.erb b/templates/zuul.vhost.erb
index 31df1b8..990ca29 100644
--- a/templates/zuul.vhost.erb
+++ b/templates/zuul.vhost.erb
@@ -1,6 +1,6 @@
 <VirtualHost *:80>
   ServerName <%= @vhost_name %>
-  ServerAdmin <%= @serveradmin %>
+  ServerAdmin <%= scope.lookupvar('::zuul::serveradmin') %>
   DocumentRoot /var/lib/zuul/www
 
   <Directory /var/lib/zuul/www>
@@ -29,15 +29,15 @@
   CustomLog ${APACHE_LOG_DIR}/<%= @vhost_name %>-access.log combined
 
   RewriteEngine on
-  <% @block_referers.each do |referer| -%>
+  <% scope.lookupvar('::zuul::block_referers').each do |referer| -%>
   RewriteCond %{HTTP_REFERER} =<%= referer %>
   RewriteRule ^/status - [F]
   RewriteCond %{HTTP_REFERER} =<%= referer %>
   RewriteRule ^/status.json - [F]
   <% end -%>
 
-  RewriteRule ^/status.json$ <%= @zuul_status_url %>/status.json [P]
-  RewriteRule ^/status/(.*) <%= @zuul_status_url %>/status/$1 [P]
+  RewriteRule ^/status.json$ <%= scope.lookupvar('::zuul::zuul_status_url') %>/status.json [P]
+  RewriteRule ^/status/(.*) <%= scope.lookupvar('::zuul::zuul_status_url') %>/status/$1 [P]
 
   AddOutputFilterByType DEFLATE application/json
 
@@ -69,17 +69,17 @@
   </IfModule>
 </VirtualHost>
 
-<% if @proxy_ssl_cert_file_contents != '' %>
+<% if scope.lookupvar('::zuul::proxy_ssl_cert_file_contents') != '' %>
 <IfModule mod_ssl.c>
 <VirtualHost *:443>
   ServerName <%= @vhost_name %>
-  ServerAdmin <%= @serveradmin %>
+  ServerAdmin <%= scope.lookupvar('::zuul::serveradmin') %>
   DocumentRoot /var/lib/zuul/www
   SSLEngine on
   SSLProtocol All -SSLv2 -SSLv3
   SSLCertificateFile /etc/ssl/certs/<%= @vhost_name %>.pem
   SSLCertificateKeyFile /etc/ssl/private/<%= @vhost_name %>.key
-<% if @proxy_ssl_chain_file_contents != '' %>
+<% if scope.lookupvar('::zuul::proxy_ssl_chain_file_contents') != '' %>
   SSLCertificateChainFile /etc/ssl/certs/<%= @vhost_name %>_intermediate.pem
 <% end %>
 
@@ -109,15 +109,15 @@
   CustomLog ${APACHE_LOG_DIR}/<%= @vhost_name %>-access.log combined
 
   RewriteEngine on
-  <% @block_referers.each do |referer| -%>
+  <% scope.lookupvar('::zuul::block_referers').each do |referer| -%>
   RewriteCond %{HTTP_REFERER} =<%= referer %>
   RewriteRule ^/status - [F]
   RewriteCond %{HTTP_REFERER} =<%= referer %>
   RewriteRule ^/status.json - [F]
   <% end -%>
 
-  RewriteRule ^/status.json$ <%= @zuul_status_url %>/status.json [P]
-  RewriteRule ^/status/(.*) <%= @zuul_status_url %>/status/$1 [P]
+  RewriteRule ^/status.json$ <%= scope.lookupvar('::zuul::zuul_status_url') %>/status.json [P]
+  RewriteRule ^/status/(.*) <%= scope.lookupvar('::zuul::zuul_status_url') %>/status/$1 [P]
 
   AddOutputFilterByType DEFLATE application/json
 
diff --git a/templates/zuulv3.vhost.erb b/templates/zuulv3.vhost.erb
index 5d35e22..122a635 100644
--- a/templates/zuulv3.vhost.erb
+++ b/templates/zuulv3.vhost.erb
@@ -8,13 +8,13 @@
   SSLProtocol All -SSLv2 -SSLv3
   SSLCertificateFile /etc/ssl/certs/<%= @vhost_name %>.pem
   SSLCertificateKeyFile /etc/ssl/private/<%= @vhost_name %>.key
-<% if @ssl_chain_file_contents != '' -%>
+<% if scope.lookupvar('::zuul::web::ssl_chain_file_contents') != '' -%>
   SSLCertificateChainFile /etc/ssl/certs/<%= @vhost_name %>_intermediate.pem
 <% end -%>
 <% end -%>
 
   ServerName <%= @vhost_name %>
-  ServerAdmin <%= @serveradmin %>
+  ServerAdmin <%= scope.lookupvar('::zuul::web::serveradmin') %>
 
   DocumentRoot <%= @docroot %>
   <Directory <%= @docroot %>>
@@ -34,23 +34,23 @@
   CustomLog ${APACHE_LOG_DIR}/<%= @vhost_name %>-access.log combined
 
   RewriteEngine on
-  <% @block_referers.each do |referer| -%>
+  <% scope.lookupvar('::zuul::web::block_referers').each do |referer| -%>
   RewriteCond %{HTTP_REFERER} =<%= referer %>
   RewriteRule ^/status - [F]
   <% end -%>
 
-  <% if @tenant_name != '' -%>
+  <% if scope.lookupvar('::zuul::web::tenant_name') != '' -%>
   RewriteRule ^/$ /status.html [L]
   # Backwards compat for old status urls. Should be removed in a few weeks.
-  RewriteRule ^/status$ <%= @web_url %>/api/tenant/<%= @tenant_name %>/status [P]
-  RewriteRule ^/api/connection/(.*)$ <%= @web_url %>/api/connection/$1 [P]
-  RewriteRule ^/api/console-stream <%= @websocket_url %>/api/tenant/<%= @tenant_name %>/console-stream [P]
-  RewriteRule ^/api/(.*)$ <%= @web_url %>/api/tenant/<%= @tenant_name %>/$1 [P]
+  RewriteRule ^/status$ <%= scope.lookupvar('::zuul::web::web_url') %>/api/tenant/<%= scope.lookupvar('::zuul::web::tenant_name') %>/status [P]
+  RewriteRule ^/api/connection/(.*)$ <%= scope.lookupvar('::zuul::web::web_url') %>/api/connection/$1 [P]
+  RewriteRule ^/api/console-stream <%= scope.lookupvar('::zuul::web::websocket_url') %>/api/tenant/<%= scope.lookupvar('::zuul::web::tenant_name') %>/console-stream [P]
+  RewriteRule ^/api/(.*)$ <%= scope.lookupvar('::zuul::web::web_url') %>/api/tenant/<%= scope.lookupvar('::zuul::web::tenant_name') %>/$1 [P]
   <% else -%>
   RewriteRule ^/$ /tenants.html [L]
   RewriteRule ^/t/(.*) /$1 [L]
-  RewriteRule ^/api/tenant/(.*)/console-stream <%= @websocket_url %>/api/tenant/$1/console-stream [P]
-  RewriteRule ^/api/(.*)$ <%= @web_url %>/api/$1 [P]
+  RewriteRule ^/api/tenant/(.*)/console-stream <%= scope.lookupvar('::zuul::web::websocket_url') %>/api/tenant/$1/console-stream [P]
+  RewriteRule ^/api/(.*)$ <%= scope.lookupvar('::zuul::web::web_url') %>/api/$1 [P]
   <% end -%>
 
   AddOutputFilterByType DEFLATE application/json