diff --git a/guix/scripts/substitute-binary.scm b/guix/scripts/substitute-binary.scm
index 8e08bf117236cbb7a7d129c327341dde62d03cae..f61d06a05c762cd5557fe04596d4ab8757a54d7c 100755
--- a/guix/scripts/substitute-binary.scm
+++ b/guix/scripts/substitute-binary.scm
@@ -630,9 +630,10 @@ (define (guix-substitute-binary . args)
    (with-error-handling                           ; for signature errors
      (match args
        (("--query")
-        (let ((cache (delay (open-cache %cache-url))))
+        (let ((cache (delay (open-cache %cache-url)))
+              (acl   (current-acl)))
           (define (valid? obj)
-            (and (narinfo? obj) (valid-narinfo? obj)))
+            (and (narinfo? obj) (valid-narinfo? obj acl)))
 
           (let loop ((command (read-line)))
             (or (eof-object? command)