Found the answer myself: use regsub on host

http-request set-var(txn.host) hdr(Host)
acl internal_set var(txn.host) -m end -i .internal.example.net

http-request redirect code 301 prefix https://%[var(txn.host),regsub(example.net,internal.example.net,g)] unless internal_set