diff --git a/db/seeds.d/200_features.rb b/db/seeds.d/200_features.rb
new file mode 100644
index 000000000..aad607354
--- /dev/null
+++ b/db/seeds.d/200_features.rb
@@ -0,0 +1,4 @@
+ForemanRhCloud.on_prem_smart_proxy_features.each do |feature_name|
+  f = Feature.where(:name => feature_name).first_or_create
+  raise "Unable to create proxy feature: #{SeedHelper.format_errors f}" if f.nil? || f.errors.any?
+end
diff --git a/lib/foreman_rh_cloud/engine.rb b/lib/foreman_rh_cloud/engine.rb
index 64f51acab..f20269c9a 100644
--- a/lib/foreman_rh_cloud/engine.rb
+++ b/lib/foreman_rh_cloud/engine.rb
@@ -210,6 +210,30 @@ def self.register_scheduled_task(task_class, cronline)
       )
     end
 
+    # Ideally this code belongs to an initializer. The problem is that Katello controllers are not initialized completely until after the end of the to_prepare blocks
+    # This means I can patch the controller only in the after_initialize block that is promised to run after the to_prepare
+    # initializer 'foreman_rh_cloud.allow_smart_proxy_actions', :before => :finisher_hook, :after => 'katello.register_plugin'  do |_app|
+    # end
+    config.after_initialize do
+      # skip overrides in migrations, since the controller initialization depends on tables existense
+      if defined?(Katello) && !Foreman.in_setup_db_rake?
+        Katello::Api::V2::OrganizationsController.include Foreman::Controller::SmartProxyAuth
+        # patch the callbacks order for :download_debug_certificate, since local_find_taxonomy has to run after the user is already initialized
+        Katello::Api::V2::OrganizationsController.skip_before_action(:local_find_taxonomy, only: :download_debug_certificate)
+        Katello::Api::V2::OrganizationsController.add_smart_proxy_filters(
+          [:index, :download_debug_certificate],
+          features: ForemanRhCloud.on_prem_smart_proxy_features
+        )
+        Katello::Api::V2::OrganizationsController.before_action(:local_find_taxonomy, only: :download_debug_certificate)
+
+        Katello::Api::V2::RepositoriesController.include Foreman::Controller::SmartProxyAuth
+        Katello::Api::V2::RepositoriesController.add_smart_proxy_filters(
+          :index,
+          features: ForemanRhCloud.on_prem_smart_proxy_features
+        )
+      end
+    end
+
     rake_tasks do
       Rake::Task['db:seed'].enhance do
         ForemanRhCloud::Engine.load_seed
@@ -231,4 +255,8 @@ def self.ca_cert
       ::SETTINGS[:ssl_ca_file]
     end
   end
+
+  def self.on_prem_smart_proxy_features
+    ['Insights']
+  end
 end
diff --git a/test/controllers/insights_cloud/api/cloud_request_controller_test.rb b/test/controllers/insights_cloud/api/cloud_request_controller_test.rb
index f57a251e2..a84422e87 100644
--- a/test/controllers/insights_cloud/api/cloud_request_controller_test.rb
+++ b/test/controllers/insights_cloud/api/cloud_request_controller_test.rb
@@ -51,8 +51,7 @@ class CloudRequestControllerTest < ActionController::TestCase
       mock_composer = mock('composer')
       ::JobInvocationComposer.expects(:for_feature).with do |feature, host_ids, params|
         feature == :rh_cloud_connector_run_playbook &&
-        host_ids.first == host1.id &&
-        host_ids.last == host2.id
+        host_ids.sort == [host1.id, host2.id].sort
       end.returns(mock_composer)
       mock_composer.expects(:trigger!)
       mock_composer.expects(:job_invocation)
diff --git a/test/unit/rh_cloud_http_proxy_test.rb b/test/unit/rh_cloud_http_proxy_test.rb
index 5acb5ef71..42a51b778 100644
--- a/test/unit/rh_cloud_http_proxy_test.rb
+++ b/test/unit/rh_cloud_http_proxy_test.rb
@@ -4,6 +4,7 @@ class RhCloudHttpProxyTest < ActiveSupport::TestCase
   setup do
     @global_content_proxy_mock = 'http://global:content@localhost:80'
     @global_foreman_proxy_mock = 'http://global:foreman@localhost:80'
+    ForemanRhCloud.stubs(:with_local_advisor_engine?).returns(false)
   end
 
   test 'selects global content proxy' do
@@ -18,6 +19,13 @@ class RhCloudHttpProxyTest < ActiveSupport::TestCase
     assert_equal @global_foreman_proxy_mock, ForemanRhCloud.proxy_setting
   end
 
+  test 'returns empty string in on-prem setup' do
+    ForemanRhCloud.unstub(:with_local_advisor_engine?)
+    ForemanRhCloud.stubs(:with_local_advisor_engine?).returns(true)
+
+    assert_empty ForemanRhCloud.proxy_setting
+  end
+
   def setup_global_content_proxy
     http_proxy = FactoryBot.create(:http_proxy, url: @global_content_proxy_mock)
     HttpProxy.stubs(:default_global_content_proxy).returns(http_proxy)