diff --git a/guix/scripts/substitute.scm b/guix/scripts/substitute.scm
index fc6bb54301f936a2ebe6556b0f1e3eb56e924c2e..f01c11b020a59d9e7269ce06e068e61de0fc2033 100755
--- a/guix/scripts/substitute.scm
+++ b/guix/scripts/substitute.scm
@@ -322,7 +322,8 @@ (define %unreachable-hosts
 (define* (open-connection-for-uri/maybe uri
                                         #:key
                                         fresh?
-                                        (time %fetch-timeout))
+                                        (time %fetch-timeout)
+                                        verify-certificate?)
   "Open a connection to URI via 'open-connection-for-uri/cached' and return a
 port to it, or, if connection failed, print a warning and return #f.  Pass
 #:fresh? to 'open-connection-for-uri/cached'."
@@ -332,7 +333,8 @@ (define host
   (catch #t
     (lambda ()
       (open-connection-for-uri/cached uri #:timeout time
-                                      #:fresh? fresh?))
+                                      #:fresh? fresh?
+                                      #:verify-certificate? verify-certificate?))
     (match-lambda*
       (('getaddrinfo-error error)
        (unless (hash-ref %unreachable-hosts host)