diff --git a/pkgs/nomarchy-install/nomarchy-install.sh b/pkgs/nomarchy-install/nomarchy-install.sh
index 96ecb72..4509874 100644
--- a/pkgs/nomarchy-install/nomarchy-install.sh
+++ b/pkgs/nomarchy-install/nomarchy-install.sh
@@ -75,9 +75,15 @@ export NIX_CONFIG="flake-registry = $SHARE/registry.json"
 # nixos-install builds with --store /mnt and its own "auto?trusted=1"
 # substituter resolves to the TARGET store (i.e. itself), so without
 # this nothing flows from the ISO and nix bootstraps gcc from source.
+NIXOS_INSTALL_OPTS=()
 if ! timeout 3 bash -c '</dev/tcp/cache.nixos.org/443' 2>/dev/null; then
     info "No network — substituting from the ISO store only."
     NIX_CONFIG+=$'\nsubstituters =\nextra-substituters = daemon?trusted=1\nbuilders ='
+    # Must ALSO go through nixos-install as a flag: it passes its own
+    # --extra-substituters "auto?trusted=1", and flags override the env
+    # config for the same setting — without this the in-target build
+    # substitutes from itself (= nothing) and bootstraps gcc from source.
+    NIXOS_INSTALL_OPTS+=(--substituters "daemon?trusted=1")
 fi
 
 # ─── Disk selection ─────────────────────────────────────────────────────
@@ -431,7 +437,7 @@ else
     warn "flake archive failed — first rebuild will need network."
 fi
 
-nixos-install --no-root-passwd --flake "$FLAKE_DIR#default"
+nixos-install --no-root-passwd "${NIXOS_INSTALL_OPTS[@]}" --flake "$FLAKE_DIR#default"
 success "System installed (bootloader in place)"
 
 # Pre-activate the Home Manager generation so the FIRST boot lands in the