diff --git a/shuttle/src/nix_config.rs b/shuttle/src/nix_config.rs
index 275a5771..275667d6 100644
--- a/shuttle/src/nix_config.rs
+++ b/shuttle/src/nix_config.rs
@@ -45,10 +45,12 @@ pub struct RuntimeCacheConfig {
 }
 
 // configures nix daemon with the configuration passed from host
-pub async fn configure(init: &v1::Init, read_proxy_url: &str) -> Result<RuntimeCacheConfig> {
-    let read_urls = vec![read_proxy_url.to_owned()];
+pub async fn configure(
+    init: &v1::Init,
+    read_proxy_url: Option<&str>,
+) -> Result<RuntimeCacheConfig> {
     let cfg = RuntimeCacheConfig {
-        read_urls,
+        read_urls: read_proxy_url.map(str::to_owned).into_iter().collect(),
         trusted_public_keys: clean_strings(&init.cache_trusted_public_keys),
     };
 
@@ -64,13 +66,10 @@ pub async fn configure(init: &v1::Init, read_proxy_url: &str) -> Result<RuntimeC
     write_file_atomic(SPINDLE_CACHE_CONFIG, &cache_json, 0o600)?;
 
     let mut nix_conf = String::new();
+    // not extra-substituters, so nix drops its default cache.nixos.org and
+    // every fetch goes through the proxy
     if !cfg.read_urls.is_empty() {
-        writeln!(
-            &mut nix_conf,
-            "extra-substituters = {}",
-            cfg.read_urls.join(" ")
-        )
-        .unwrap();
+        writeln!(&mut nix_conf, "substituters = {}", cfg.read_urls.join(" ")).unwrap();
     }
     if !cfg.trusted_public_keys.is_empty() {
         writeln!(
diff --git a/shuttle/src/session.rs b/shuttle/src/session.rs
index 41ff6c36..9c1cfc49 100644
--- a/shuttle/src/session.rs
+++ b/shuttle/src/session.rs
@@ -45,12 +45,9 @@ pub async fn run(host_cid: u32, port: u32) -> Result<()> {
     let _dns_proxy = DnsProxy::start(host_cid, init.dns_proxy_port)
         .await
         .context("start dns proxy")?;
-    let _cache_cfg = nix_config::configure(
-        &init,
-        read_proxy.as_ref().map(ReadCacheProxy::url).unwrap_or(""),
-    )
-    .await
-    .context("configure nix cache")?;
+    let _cache_cfg = nix_config::configure(&init, read_proxy.as_ref().map(ReadCacheProxy::url))
+        .await
+        .context("configure nix cache")?;
     let uploader = CacheUploadManager::start(
         write_proxy.as_ref().map(WriteCacheProxy::url).unwrap_or(""),
         out_tx.clone(),
diff --git a/spindle/engines/microvm/test-spindle-microvm.sh b/spindle/engines/microvm/test-spindle-microvm.sh
index 608c52f2..b5f0b477 100755
--- a/spindle/engines/microvm/test-spindle-microvm.sh
+++ b/spindle/engines/microvm/test-spindle-microvm.sh
@@ -489,7 +489,7 @@ test_realize() {
     out=$(run_vm --name "realize" --timeout "60s" -- /run/current-system/sw/bin/bash -lc '
 set -euo pipefail
 store_path=$1
-cache_url=$(sed -n "s/^extra-substituters = //p" /run/spindle/nix.conf)
+cache_url=$(sed -n "s/^substituters = //p" /run/spindle/nix.conf)
 cache_url=${cache_url%% *}
 if [ -z "$cache_url" ]; then
     echo "error: cache URL not found in /run/spindle/nix.conf" >&2