diff --git a/nix/module-eval/hive-tls.nix b/nix/module-eval/hive-tls.nix
index b8ab9aa29..21ba6537c 100644
--- a/nix/module-eval/hive-tls.nix
+++ b/nix/module-eval/hive-tls.nix
@@ -888,6 +888,9 @@ let
         let
           u = units.hive-priv-cache-facts;
           c0re = allLocal.systemd.services.hive-c0re.environment;
+          # The system bundle is a store path; `hasInfix` matches by regex, which refuses a string that carries one.
+          plain = builtins.unsafeDiscardStringContext;
+          systemBase = plain "base_bundle=${allLocal.security.pki.caBundle}";
         in
         lib.hasInfix "!include /run/hyperhive-nix/cache.conf" allLocal.nix.extraOptions
         && !(lib.hasInfix "hyperhive-nix" noIdentity.nix.extraOptions)
@@ -907,9 +910,11 @@ let
         && lib.hasInfix "swarm_ca=/var/lib/hive-tls/swarm-services-root.pem" u.script
         && lib.hasInfix ''atomic_write_secret 0644 "" "$ca_bundle_file"'' u.script
         # No ssl-cert-file on the host: the system bundle is the base. A host that sets one is merged, not replaced.
-        && lib.hasInfix "base_bundle=${allLocal.security.pki.caBundle}" u.script
-        && lib.hasInfix "base_bundle=/etc/pki/host-ca.pem" noService.systemd.services.hive-priv-cache-facts.script
-        && !(lib.hasInfix "base_bundle=${allLocal.security.pki.caBundle}" noService.systemd.services.hive-priv-cache-facts.script)
+        && lib.hasInfix systemBase (plain u.script)
+        && lib.hasInfix "base_bundle=/etc/pki/host-ca.pem" (
+          plain noService.systemd.services.hive-priv-cache-facts.script
+        )
+        && !(lib.hasInfix systemBase (plain noService.systemd.services.hive-priv-cache-facts.script))
         # No client copy of the token for hive-core, and hive-c0re is not told the cache.
         && !(lib.hasInfix "client_netrc" u.script)
         && !(c0re ? HIVE_C0RE_CACHE_URL)