diff --git a/cdap-gateway/src/main/java/io/cdap/cdap/gateway/router/RouterPathLookup.java b/cdap-gateway/src/main/java/io/cdap/cdap/gateway/router/RouterPathLookup.java
index 1eb087bdda7f..3be364f666d9 100644
--- a/cdap-gateway/src/main/java/io/cdap/cdap/gateway/router/RouterPathLookup.java
+++ b/cdap-gateway/src/main/java/io/cdap/cdap/gateway/router/RouterPathLookup.java
@@ -76,6 +76,14 @@ public RouteDestination getRoutingService(String requestPath, HttpRequest httpRe
           .stream(Splitter.on('/').omitEmptyStrings().split(requestPath).spliterator(), false)
           .toArray(String[]::new);
 
+      if (uriParts.length == 0) {
+        return APP_FABRIC_HTTP;
+      }
+      if (uriParts[0].equals(Constants.Gateway.INTERNAL_API_VERSION_3_TOKEN)) {
+        // The internal API is for service-to-service calls over internal service
+        // discovery and must never be reachable through the external router.
+        return DONT_ROUTE;
+      }
       if (uriParts[0].equals(Constants.Gateway.API_VERSION_3_TOKEN)) {
         return getV3RoutingService(uriParts, requestMethod);
       }
diff --git a/cdap-gateway/src/test/java/io/cdap/cdap/gateway/router/RouterPathLookupTest.java b/cdap-gateway/src/test/java/io/cdap/cdap/gateway/router/RouterPathLookupTest.java
index d13317db78a8..ca4d00ed1597 100644
--- a/cdap-gateway/src/test/java/io/cdap/cdap/gateway/router/RouterPathLookupTest.java
+++ b/cdap-gateway/src/test/java/io/cdap/cdap/gateway/router/RouterPathLookupTest.java
@@ -426,8 +426,13 @@ public void testAppLifecycleAndWorkflowPaths() {
 
   @Test
   public void testProgramLifecycleInternalAndAppLifecycleInternalPaths() {
+    // The internal (v3Internal) API is for service-to-service calls over internal
+    // discovery and must not be routed from the external router.
     assertRouting("v3Internal/namespaces//apps//versions//workflows/DataPipelineWorkflow/runs/",
-        RouterPathLookup.APP_FABRIC_HTTP);
+        RouterPathLookup.DONT_ROUTE);
+    assertRouting("v3Internal/namespaces/default/apps/app/states/key", RouterPathLookup.DONT_ROUTE);
+    assertRouting("v3Internal/namespaces/default/apps/app/preferences", RouterPathLookup.DONT_ROUTE);
+    assertRouting("v3Internal/location/some/abs/path", RouterPathLookup.DONT_ROUTE);
   }
 
   @Test