diff --git a/guix/build/download-nar.scm b/guix/build/download-nar.scm
index 681f22238d..cb146038ad 100644
--- a/guix/build/download-nar.scm
+++ b/guix/build/download-nar.scm
@@ -42,10 +42,10 @@
   "Return the fallback nar URL for ITEM--e.g.,
 \"/gnu/store/cabbag3…-foo-1.2-checkout\"."
   ;; Here we hard-code nar URLs without checking narinfos.  That's probably OK
-  ;; though.
+  ;; though.  Use berlin.guixsd.org instead of its ci.guix.gnu.org front end to
+  ;; avoid sending these requests to CDN providers without user consent.
   ;; TODO: Use HTTPS?  The downside is the extra dependency.
-  (let ((bases '("http://mirror.hydra.gnu.org/guix"
-                 "http://berlin.guixsd.org"))
+  (let ((bases '("http://berlin.guixsd.org"))
         (item  (basename item)))
     (append (map (cut string-append <> "/nar/gzip/" item) bases)
             (map (cut string-append <> "/nar/" item) bases))))
diff --git a/guix/download.scm b/guix/download.scm
index cd5d61cd13..fe680be4a2 100644
--- a/guix/download.scm
+++ b/guix/download.scm
@@ -394,7 +394,6 @@
                        '(guix base16) '(bytevector->base16-string))
 
      (list (guix-publish "ci.guix.gnu.org")
-           (guix-publish "mirror.hydra.gnu.org")
            (lambda (file algo hash)
              ;; 'tarballs.nixos.org' supports several algorithms.
              (string-append "https://tarballs.nixos.org/"