single target group for public and private traffic

I have an internal site behind an internal tls network loadbalancer (to support kerberos auth for internal traffic). I want to make the site available publicly for anonymous traffic.

I have tried setting up a public application load balancer, it doesn't let me select my existing tls target group. If I setup a new http target group with the same instances then I will have to keep that target group in sync when instances are rotated out for deployments etc. - I want to avoid this and have only the one tls target group as the source of truth for what instances are currently in rotation.

I have tried setting up a public network load balancer, it doesn't let me select my existing tls target group - it shows as being "in use". Can two load balancers not use the same target group?

I have tried creating an ip target group using the ips of the internal tls network loadbalancer, this target is not selectable from the application load balancer.

Is there a simple way to do this?