diff --git a/.gitea/workflows/check-nix-download-buffer.yaml b/.gitea/workflows/check-nix-download-buffer.yaml
index 785fa7eb..8e05e70d 100644
--- a/.gitea/workflows/check-nix-download-buffer.yaml
+++ b/.gitea/workflows/check-nix-download-buffer.yaml
@@ -17,6 +17,7 @@ jobs:
     env:
       NIX_CONFIG: |
         fallback = false
+        http2 = false
         extra-substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
         trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
     steps:
@@ -25,6 +26,7 @@ jobs:
           set -eu
           nix --version
           nix config show download-buffer-size
+          nix config show http2
           nix config show fallback
           nix config show substituters
 
diff --git a/.gitea/workflows/deploy-hectic-lab.yaml b/.gitea/workflows/deploy-hectic-lab.yaml
index 37b0235e..c26bc774 100644
--- a/.gitea/workflows/deploy-hectic-lab.yaml
+++ b/.gitea/workflows/deploy-hectic-lab.yaml
@@ -18,6 +18,7 @@ jobs:
     env:
       NIX_CONFIG: |
         fallback = true
+        http2 = false
         extra-substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
         trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
     steps:
@@ -32,6 +33,7 @@ jobs:
           set -eu
           uname -a
           nix --version
+          nix config show http2
           nix config show fallback
           nix config show download-buffer-size
           nix config show substituters
diff --git a/.gitea/workflows/deploy-neuro.yaml b/.gitea/workflows/deploy-neuro.yaml
index ef1eb517..34f52511 100644
--- a/.gitea/workflows/deploy-neuro.yaml
+++ b/.gitea/workflows/deploy-neuro.yaml
@@ -18,6 +18,7 @@ jobs:
     env:
       NIX_CONFIG: |
         fallback = true
+        http2 = false
         extra-substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
         trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
     steps:
@@ -32,6 +33,7 @@ jobs:
           set -eu
           uname -a
           nix --version
+          nix config show http2
           nix config show fallback
           nix config show substituters
           nix config show trusted-public-keys
diff --git a/.gitea/workflows/runner-nix-smoke.yaml b/.gitea/workflows/runner-nix-smoke.yaml
index bc19c4ef..3cee65ab 100644
--- a/.gitea/workflows/runner-nix-smoke.yaml
+++ b/.gitea/workflows/runner-nix-smoke.yaml
@@ -20,6 +20,11 @@ jobs:
   smoke:
     name: nix label and flake smoke
     runs-on: nix
+    env:
+      NIX_CONFIG: |
+        http2 = false
+        extra-substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
+        extra-trusted-public-keys = hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4.2.2
@@ -28,6 +33,7 @@ jobs:
         run: |
           set -eu
           nix --version
+          nix config show http2
           nix config show substituters
           nix config show trusted-public-keys
 
diff --git a/docs/attic-cache.md b/docs/attic-cache.md
index 7227d072..e84820b5 100644
--- a/docs/attic-cache.md
+++ b/docs/attic-cache.md
@@ -286,10 +286,11 @@ own whole-batch deadline. The legacy `/previous/` endpoint stays read-only.
 The host's Attic package also restricts its AWS SDK rustls connector to HTTP/1.1
 after observed S3 `REFUSED_STREAM` failures. This is a reproducible, host-scoped
 derived Cargo vendor tree; the pinned input tree and Cargo.lock are unchanged.
-TLS certificate verification remains enabled, and client-to-nginx HTTP/2 is not
-disabled. The pinned crate path makes upstream changes fail visibly during a
-future upgrade. This mitigates the observed transport error, not every possible
-Hetzner S3 timeout.
+TLS certificate verification remains enabled. Nix clients now force HTTP/1.1 for
+cache pulls because the cache endpoint has produced HTTP/2 framing errors; the
+Attic upload client separately uses HTTP/1.1 upstream. The pinned crate path
+makes upstream changes fail visibly during a future upgrade. This mitigates the
+observed transport error, not every possible Hetzner S3 timeout.
 
 ### Cache pulls do not work
 
diff --git a/infra/gitea-runners/image/README.md b/infra/gitea-runners/image/README.md
index df6e57b1..e12a064e 100644
--- a/infra/gitea-runners/image/README.md
+++ b/infra/gitea-runners/image/README.md
@@ -71,7 +71,8 @@ top-level `flake.nix`:
 ```text
 experimental-features = nix-command flakes
 substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
-trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gW4x6l1xP+GxgH0r7u+f6p1VFlr0= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
+http2 = false
+trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
 sandbox = false
 ```
 
diff --git a/package/gitea-runner-controller/hcloud.sh b/package/gitea-runner-controller/hcloud.sh
index 57627906..a03f4db6 100644
--- a/package/gitea-runner-controller/hcloud.sh
+++ b/package/gitea-runner-controller/hcloud.sh
@@ -65,10 +65,11 @@ gcr_vm_list_managed() {
 gcr_vm_build_userdata() {
     vm_name="$1"; label="$2"; reg_token="$3"
 
-    nix_conf='accept-flake-config = true
+nix_conf='accept-flake-config = true
 experimental-features = nix-command flakes
+http2 = false
 substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
-trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gW4x6l1xP+GxgH0r7u+f6p1VFlr0= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
+trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
 sandbox = false'
 
     runner_config="log:
@@ -233,8 +234,9 @@ gcr_bootstrap_script() {
     label="$1"; reg_token="$2"; ttl_min="$3"; runner_name="$4"
     nix_conf='accept-flake-config = true
 experimental-features = nix-command flakes
+http2 = false
 substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
-trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gW4x6l1xP+GxgH0r7u+f6p1VFlr0= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
+trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
 sandbox = false'
 
     runner_config="log:
diff --git a/package/gitea-runner-nix-image/default.nix b/package/gitea-runner-nix-image/default.nix
index c0c304cf..4ca29c44 100644
--- a/package/gitea-runner-nix-image/default.nix
+++ b/package/gitea-runner-nix-image/default.nix
@@ -56,7 +56,8 @@ dockerTools.buildLayeredImageWithNixDb {
     accept-flake-config = true
     experimental-features = nix-command flakes
     substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
-    trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gW4x6l1xP+GxgH0r7u+f6p1VFlr0= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
+    http2 = false
+    trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
     trusted-users = root
     sandbox = false
     EOF