diff --git a/app/assets/javascripts/discourse/models/user.js b/app/assets/javascripts/discourse/models/user.js
index dbed804ef60..617440f1d1c 100644
--- a/app/assets/javascripts/discourse/models/user.js
+++ b/app/assets/javascripts/discourse/models/user.js
@@ -416,7 +416,7 @@ Discourse.User = Discourse.Model.extend({
 Discourse.User.reopenClass(Discourse.Singleton, {
 
   avatarTemplate: function(username, uploadedAvatarId){
-    var url = Discourse.getURL("/user_avatar/" + username.toLowerCase() + "/{size}/" + uploadedAvatarId + ".png");
+    var url = Discourse.getURL("/user_avatar/" + Discourse.BaseUrl + "/" + username.toLowerCase() + "/{size}/" + uploadedAvatarId + ".png");
     if(Discourse.CDN){
       url = Discourse.CDN + url;
     }
diff --git a/app/controllers/user_avatars_controller.rb b/app/controllers/user_avatars_controller.rb
index 07629125884..5d71564d13f 100644
--- a/app/controllers/user_avatars_controller.rb
+++ b/app/controllers/user_avatars_controller.rb
@@ -20,8 +20,16 @@ class UserAvatarsController < ApplicationController
     end
   end
 
-
   def show
+    # we need multisite support to keep a single origin pull for CDNs
+    RailsMultisite::ConnectionManagement.with_hostname(params[:hostname]) do
+      show_in_site
+    end
+  end
+
+  protected
+
+  def show_in_site
     username = params[:username].to_s
     return render_dot unless user = User.find_by(username_lower: username.downcase)
 
@@ -62,7 +70,6 @@ class UserAvatarsController < ApplicationController
     end
   end
 
-  protected
 
   # this protects us from a DoS
   def render_dot
diff --git a/config/routes.rb b/config/routes.rb
index f9b9ec4ba1e..f3bd00bf976 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -212,7 +212,7 @@ Discourse::Application.routes.draw do
   delete "users/:username" => "users#destroy", constraints: {username: USERNAME_ROUTE_FORMAT}
 
   post "user_avatar/:username/refresh_gravatar" => "user_avatars#refresh_gravatar"
-  get "user_avatar/:username/:size/:version.png" => "user_avatars#show", format: false
+  get "user_avatar/:hostname/:username/:size/:version.png" => "user_avatars#show", format: false
 
 
   get "uploads/:site/:id/:sha.:extension" => "uploads#show", constraints: {site: /\w+/, id: /\d+/, sha: /[a-z0-9]{15,16}/i, extension: /\w{2,}/}
diff --git a/vendor/gems/rails_multisite/lib/rails_multisite/connection_management.rb b/vendor/gems/rails_multisite/lib/rails_multisite/connection_management.rb
index 10c916c2335..8bcfc1d866a 100644
--- a/vendor/gems/rails_multisite/lib/rails_multisite/connection_management.rb
+++ b/vendor/gems/rails_multisite/lib/rails_multisite/connection_management.rb
@@ -37,6 +37,30 @@ module RailsMultisite
       end
     end
 
+    def self.with_hostname(hostname)
+
+      unless defined? @@db_spec_cache
+        # just fake it for non multisite
+        yield hostname
+        return
+      end
+
+      old = current_hostname
+      connected = ActiveRecord::Base.connection_pool.connected?
+
+      establish_connection(:hostname => hostname) unless connected && hostname == old
+      rval = yield hostname
+
+      unless connected && hostname == old
+        ActiveRecord::Base.connection_handler.clear_active_connections!
+
+        establish_connection(:hostname => old)
+        ActiveRecord::Base.connection_handler.clear_active_connections! unless connected
+      end
+
+      rval
+    end
+
     def self.with_connection(db = "default")
       old = current_db
       connected = ActiveRecord::Base.connection_pool.connected?