diff --git a/src/libfetchers/tarball.cc b/src/libfetchers/tarball.cc
index 3e9004223..8efb8d68c 100644
--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@@ -70,7 +70,10 @@ DownloadFileResult downloadFile(
         ValidPathInfo info(store->makeFixedOutputPath(FileIngestionMethod::Flat, hash, name));
         info.narHash = hashString(HashType::SHA256, *sink.s);
         info.narSize = sink.s->size();
-        info.ca = makeFixedOutputCA(FileIngestionMethod::Flat, hash);
+        info.ca = FileSystemHash {
+            .method = FileIngestionMethod::Flat,
+            .hash = hash,
+        };
         store->addToStore(info, sink.s, NoRepair, NoCheckSigs);
         storePath = std::move(info.path);
     }
diff --git a/src/libstore/build.cc b/src/libstore/build.cc
index e35044532..7f79d6a2a 100644
--- a/src/libstore/build.cc
+++ b/src/libstore/build.cc
@@ -3708,7 +3708,7 @@ void DerivationGoal::registerOutputs()
         /* Check that fixed-output derivations produced the right
            outputs (i.e., the content hash should match the specified
            hash). */
-        std::string ca;
+        std::optional<ContentAddress> ca;
 
         if (fixedOutput) {
 
@@ -3757,7 +3757,10 @@ void DerivationGoal::registerOutputs()
             else
                 assert(worker.store.parseStorePath(path) == dest);
 
-            ca = makeFixedOutputCA(i.second.hash->method, h2);
+            ca = FileSystemHash {
+                .method = i.second.hash->method,
+                .hash = h2,
+            };
         }
 
         /* Get rid of all weird permissions.  This also checks that
@@ -3830,7 +3833,10 @@ void DerivationGoal::registerOutputs()
         info.ca = ca;
         worker.store.signPathInfo(info);
 
-        if (!info.references.empty()) info.ca.clear();
+        if (!info.references.empty()) {
+            // FIXME don't we have an experimental feature for fixed output with references?
+            info.ca = {};
+        }
 
         infos.emplace(i.first, std::move(info));
     }
diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index 1f950de63..45bfa6753 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -650,7 +650,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
             if (GET_PROTOCOL_MINOR(clientVersion) >= 16) {
                 to << info->ultimate
                    << info->sigs
-                   << info->ca;
+                   << renderContentAddress(info->ca);
             }
         } else {
             assert(GET_PROTOCOL_MINOR(clientVersion) >= 17);
@@ -708,7 +708,12 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         info.references = readStorePaths<StorePathSet>(*store, from);
         from >> info.registrationTime >> info.narSize >> info.ultimate;
         info.sigs = readStrings<StringSet>(from);
-        from >> info.ca >> repair >> dontCheckSigs;
+        {
+            string caOptRaw;
+            from >> caOptRaw;
+            info.ca = parseCaOpt(caOptRaw);
+        }
+        from >> repair >> dontCheckSigs;
         if (!trusted && dontCheckSigs)
             dontCheckSigs = false;
         if (!trusted)
diff --git a/src/libstore/file-hash.cc b/src/libstore/file-hash.cc
index ebd732759..494079c18 100644
--- a/src/libstore/file-hash.cc
+++ b/src/libstore/file-hash.cc
@@ -38,8 +38,16 @@ std::string renderContentAddress(ContentAddress ca) {
     }, ca);
 }
 
-std::string renderContentAddress(std::optionalContent<Address> ca) {
-    return ca ? renderContentAddress(*ca) else "";
+ContentAddress parseCa(std::string_view rawCa) {
+    throw Error("TODO");
+};
+
+std::optional<ContentAddress> parseCaOpt(std::string_view rawCaOpt) {
+    return rawCaOpt == "" ? std::optional<ContentAddress> {} : parseCa(rawCaOpt);
+};
+
+std::string renderContentAddress(std::optional<ContentAddress> ca) {
+    return ca ? renderContentAddress(*ca) : "";
 }
 
 }
diff --git a/src/libstore/file-hash.hh b/src/libstore/file-hash.hh
index e33878bf9..9d12f5fe7 100644
--- a/src/libstore/file-hash.hh
+++ b/src/libstore/file-hash.hh
@@ -12,6 +12,9 @@ enum struct FileIngestionMethod : uint8_t {
 
 struct TextHash {
     Hash hash;
+    TextHash(const TextHash &) = default;
+    TextHash(TextHash &&) = default;
+    TextHash & operator = (const TextHash &) = default;
 };
 
 /// Pair of a hash, and how the file system was ingested
@@ -56,4 +59,8 @@ std::string renderContentAddress(ContentAddress ca);
 
 std::string renderContentAddress(std::optional<ContentAddress> ca);
 
+ContentAddress parseCa(std::string_view rawCa);
+
+std::optional<ContentAddress> parseCaOpt(std::string_view rawCaOpt);
+
 }
diff --git a/src/libstore/legacy-ssh-store.cc b/src/libstore/legacy-ssh-store.cc
index 61e7603b7..8471ed073 100644
--- a/src/libstore/legacy-ssh-store.cc
+++ b/src/libstore/legacy-ssh-store.cc
@@ -114,7 +114,11 @@ struct LegacySSHStore : public Store
             if (GET_PROTOCOL_MINOR(conn->remoteVersion) >= 4) {
                 auto s = readString(conn->from);
                 info->narHash = s.empty() ? Hash() : Hash(s);
-                conn->from >> info->ca;
+                {
+                    std::string rawCaOpt;
+                    conn->from >> rawCaOpt;
+                    info->ca = parseCaOpt(rawCaOpt);
+                }
                 info->sigs = readStrings<StringSet>(conn->from);
             }
 
@@ -146,7 +150,7 @@ struct LegacySSHStore : public Store
                 << info.narSize
                 << info.ultimate
                 << info.sigs
-                << info.ca;
+                << renderContentAddress(info.ca);
             try {
                 copyNAR(source, conn->to);
             } catch (...) {
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index 9b60bf887..fe346f96a 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -576,7 +576,7 @@ void LocalStore::checkDerivationOutputs(const StorePath & drvPath, const Derivat
 uint64_t LocalStore::addValidPath(State & state,
     const ValidPathInfo & info, bool checkOutputs)
 {
-    if (info.ca != "" && !info.isContentAddressed(*this))
+    if (info.ca && !info.isContentAddressed(*this))
         throw Error("cannot add path '%s' to the Nix store because it claims to be content-addressed but isn't",
             printStorePath(info.path));
 
@@ -588,7 +588,7 @@ uint64_t LocalStore::addValidPath(State & state,
         (info.narSize, info.narSize != 0)
         (info.ultimate ? 1 : 0, info.ultimate)
         (concatStringsSep(" ", info.sigs), !info.sigs.empty())
-        (info.ca, !info.ca.empty())
+        (renderContentAddress(info.ca), (bool) info.ca)
         .exec();
     uint64_t id = sqlite3_last_insert_rowid(state.db);
 
@@ -662,7 +662,7 @@ void LocalStore::queryPathInfoUncached(const StorePath & path,
             if (s) info->sigs = tokenizeString<StringSet>(s, " ");
 
             s = (const char *) sqlite3_column_text(state->stmtQueryPathInfo, 7);
-            if (s) info->ca = s;
+            if (s) info->ca = parseCaOpt(s);
 
             /* Get the references. */
             auto useQueryReferences(state->stmtQueryReferences.use()(info->id));
@@ -685,7 +685,7 @@ void LocalStore::updatePathInfo(State & state, const ValidPathInfo & info)
         (info.narHash.to_string(Base::Base16))
         (info.ultimate ? 1 : 0, info.ultimate)
         (concatStringsSep(" ", info.sigs), !info.sigs.empty())
-        (info.ca, !info.ca.empty())
+        (renderContentAddress(info.ca), (bool) info.ca)
         (printStorePath(info.path))
         .exec();
 }
@@ -999,15 +999,13 @@ void LocalStore::addToStore(const ValidPathInfo & info, Source & source,
 
             deletePath(realPath);
 
-            if (info.ca != "" &&
-                !((hasPrefix(info.ca, "text:") && !info.references.count(info.path))
-                    || info.references.empty()))
+            if (info.ca && !info.references.empty() && !std::holds_alternative<TextHash>(*info.ca))
                 settings.requireExperimentalFeature("ca-references");
 
             /* While restoring the path from the NAR, compute the hash
                of the NAR. */
             std::unique_ptr<AbstractHashSink> hashSink;
-            if (info.ca == "" || !info.references.count(info.path))
+            if (info.ca || !info.references.count(info.path))
                 hashSink = std::make_unique<HashSink>(HashType::SHA256);
             else
                 hashSink = std::make_unique<HashModuloSink>(HashType::SHA256, storePathToHash(printStorePath(info.path)));
@@ -1093,7 +1091,10 @@ StorePath LocalStore::addToStoreFromDump(const string & dump, const string & nam
             ValidPathInfo info(dstPath.clone());
             info.narHash = hash.first;
             info.narSize = hash.second;
-            info.ca = makeFixedOutputCA(method, h);
+            info.ca = FileSystemHash {
+                .method = method,
+                .hash = h,
+            };
             registerValidPath(info);
         }
 
@@ -1157,7 +1158,7 @@ StorePath LocalStore::addTextToStore(const string & name, const string & s,
             info.narHash = narHash;
             info.narSize = sink.s->size();
             info.references = cloneStorePathSet(references);
-            info.ca = "text:" + hash.to_string();
+            info.ca = TextHash { .hash = hash };
             registerValidPath(info);
         }
 
@@ -1265,7 +1266,7 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
                 printMsg(Verbosity::Talkative, "checking contents of '%s'", printStorePath(i));
 
                 std::unique_ptr<AbstractHashSink> hashSink;
-                if (info->ca == "" || !info->references.count(info->path))
+                if (info->ca || !info->references.count(info->path))
                     hashSink = std::make_unique<HashSink>(info->narHash.type);
                 else
                     hashSink = std::make_unique<HashModuloSink>(info->narHash.type, storePathToHash(printStorePath(info->path)));
diff --git a/src/libstore/nar-info-disk-cache.cc b/src/libstore/nar-info-disk-cache.cc
index 442541330..b4346d4d1 100644
--- a/src/libstore/nar-info-disk-cache.cc
+++ b/src/libstore/nar-info-disk-cache.cc
@@ -203,7 +203,7 @@ public:
                 narInfo->deriver = StorePath::fromBaseName(queryNAR.getStr(9));
             for (auto & sig : tokenizeString<Strings>(queryNAR.getStr(10), " "))
                 narInfo->sigs.insert(sig);
-            narInfo->ca = queryNAR.getStr(11);
+            narInfo->ca = parseCaOpt(queryNAR.getStr(11));
 
             return {oValid, narInfo};
         });
@@ -237,7 +237,7 @@ public:
                     (concatStringsSep(" ", info->shortRefs()))
                     (info->deriver ? std::string(info->deriver->to_string()) : "", (bool) info->deriver)
                     (concatStringsSep(" ", info->sigs))
-                    (info->ca)
+                    (renderContentAddress(info->ca))
                     (time(0)).exec();
 
             } else {
diff --git a/src/libstore/nar-info.cc b/src/libstore/nar-info.cc
index 8592ee968..4f7c732ce 100644
--- a/src/libstore/nar-info.cc
+++ b/src/libstore/nar-info.cc
@@ -67,8 +67,9 @@ NarInfo::NarInfo(const Store & store, const std::string & s, const std::string &
         else if (name == "Sig")
             sigs.insert(value);
         else if (name == "CA") {
-            if (!ca.empty()) corrupt();
-            ca = value;
+            if (ca) corrupt();
+            // FIXME: allow blank ca or require skipping field?
+            ca = parseCaOpt(value);
         }
 
         pos = eol + 1;
@@ -104,8 +105,8 @@ std::string NarInfo::to_string(const Store & store) const
     for (auto sig : sigs)
         res += "Sig: " + sig + "\n";
 
-    if (!ca.empty())
-        res += "CA: " + ca + "\n";
+    if (ca)
+        res += "CA: " + renderContentAddress(*ca) + "\n";
 
     return res;
 }
diff --git a/src/libstore/remote-store.cc b/src/libstore/remote-store.cc
index 2037a55f4..2744245f3 100644
--- a/src/libstore/remote-store.cc
+++ b/src/libstore/remote-store.cc
@@ -381,7 +381,9 @@ void RemoteStore::queryPathInfoUncached(const StorePath & path,
             if (GET_PROTOCOL_MINOR(conn->daemonVersion) >= 16) {
                 conn->from >> info->ultimate;
                 info->sigs = readStrings<StringSet>(conn->from);
-                conn->from >> info->ca;
+                string caOptRaw;
+                conn->from >> caOptRaw;
+                info->ca = parseCaOpt(caOptRaw);
             }
         }
         callback(std::move(info));
@@ -474,7 +476,7 @@ void RemoteStore::addToStore(const ValidPathInfo & info, Source & source,
                  << info.narHash.to_string(Base::Base16, false);
         writeStorePaths(*this, conn->to, info.references);
         conn->to << info.registrationTime << info.narSize
-                 << info.ultimate << info.sigs << info.ca
+                 << info.ultimate << info.sigs << renderContentAddress(info.ca)
                  << repair << !checkSigs;
         bool tunnel = GET_PROTOCOL_MINOR(conn->daemonVersion) >= 21;
         if (!tunnel) copyNAR(source, conn->to);
diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index 0a36dcb2b..0715f64f3 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -468,7 +468,7 @@ void Store::pathInfoToJSON(JSONPlaceholder & jsonOut, const StorePathSet & store
             }
 
             if (info->ca)
-                jsonPath.attr("ca", info->ca);
+                jsonPath.attr("ca", renderContentAddress(info->ca));
 
             std::pair<uint64_t, uint64_t> closureSizes;
 
@@ -760,24 +760,23 @@ bool ValidPathInfo::isContentAddressed(const Store & store) const
         printError("warning: path '%s' claims to be content-addressed but isn't", store.printStorePath(path));
     };
 
-    if (hasPrefix(ca, "text:")) {
-        Hash hash(std::string(ca, 5));
-        if (store.makeTextPath(path.name(), hash, references) == path)
+    if (! ca) {}
+
+    else if (auto p = std::get_if<TextHash>(&*ca)) {
+        if (store.makeTextPath(path.name(), p->hash, references) == path)
             return true;
         else
             warn();
     }
 
-    else if (hasPrefix(ca, "fixed:")) {
-        FileIngestionMethod recursive { ca.compare(6, 2, "r:") == 0 };
-        Hash hash(std::string(ca, recursive == FileIngestionMethod::Recursive ? 8 : 6));
+    else if (auto p = std::get_if<FileSystemHash>(&*ca)) {
         auto refs = cloneStorePathSet(references);
         bool hasSelfReference = false;
         if (refs.count(path)) {
             hasSelfReference = true;
             refs.erase(path);
         }
-        if (store.makeFixedOutputPath(recursive, hash, path.name(), refs, hasSelfReference) == path)
+        if (store.makeFixedOutputPath(p->method, p->hash, path.name(), refs, hasSelfReference) == path)
             return true;
         else
             warn();
diff --git a/src/libutil/tests/libutil-tests b/src/libutil/tests/libutil-tests
deleted file mode 100755
index a4f9bbbc1..000000000
Binary files a/src/libutil/tests/libutil-tests and /dev/null differ
diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc
index 6f3a59002..64ee9fd45 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@@ -944,7 +944,11 @@ static void opServe(Strings opFlags, Strings opArgs)
                 info.references = readStorePaths<StorePathSet>(*store, in);
                 in >> info.registrationTime >> info.narSize >> info.ultimate;
                 info.sigs = readStrings<StringSet>(in);
-                in >> info.ca;
+                {
+                    std::string rawCA;
+                    in >> rawCA;
+                    info.ca = parseCaOpt(rawCA);
+                }
 
                 if (info.narSize == 0)
                     throw Error("narInfo is too old and missing the narSize field");
diff --git a/src/nix/add-to-store.cc b/src/nix/add-to-store.cc
index 39d49721a..dc34a83ca 100644
--- a/src/nix/add-to-store.cc
+++ b/src/nix/add-to-store.cc
@@ -48,7 +48,10 @@ struct CmdAddToStore : MixDryRun, StoreCommand
         ValidPathInfo info(store->makeFixedOutputPath(FileIngestionMethod::Recursive, narHash, *namePart));
         info.narHash = narHash;
         info.narSize = sink.s->size();
-        info.ca = makeFixedOutputCA(FileIngestionMethod::Recursive, info.narHash);
+        *info.ca = FileSystemHash {
+            .method = FileIngestionMethod::Recursive,
+            .hash = info.narHash
+        };
 
         if (!dryRun)
             store->addToStore(info, sink.s);
diff --git a/src/nix/make-content-addressable.cc b/src/nix/make-content-addressable.cc
index bd948a983..5003ff459 100644
--- a/src/nix/make-content-addressable.cc
+++ b/src/nix/make-content-addressable.cc
@@ -82,7 +82,10 @@ struct CmdMakeContentAddressable : StorePathsCommand, MixJSON
             if (hasSelfReference) info.references.insert(info.path.clone());
             info.narHash = narHash;
             info.narSize = sink.s->size();
-            info.ca = makeFixedOutputCA(FileIngestionMethod::Recursive, info.narHash);
+            info.ca = FileSystemHash {
+                .method = FileIngestionMethod::Recursive,
+                .hash = info.narHash,
+            };
 
             if (!json)
                 printError("rewrote '%s' to '%s'", pathS, store->printStorePath(info.path));
diff --git a/src/nix/path-info.cc b/src/nix/path-info.cc
index ffe07a3ee..cda371129 100644
--- a/src/nix/path-info.cc
+++ b/src/nix/path-info.cc
@@ -115,7 +115,7 @@ struct CmdPathInfo : StorePathsCommand, MixJSON
                     std::cout << '\t';
                     Strings ss;
                     if (info->ultimate) ss.push_back("ultimate");
-                    if (info->ca != "") ss.push_back("ca:" + renderContentAddress(*info->ca));
+                    if (info->ca) ss.push_back("ca:" + renderContentAddress(*info->ca));
                     for (auto & sig : info->sigs) ss.push_back(sig);
                     std::cout << concatStringsSep(" ", ss);
                 }
diff --git a/src/nix/verify.cc b/src/nix/verify.cc
index 0c3478ff5..d8636435c 100644
--- a/src/nix/verify.cc
+++ b/src/nix/verify.cc
@@ -87,7 +87,7 @@ struct CmdVerify : StorePathsCommand
                 if (!noContents) {
 
                     std::unique_ptr<AbstractHashSink> hashSink;
-                    if (info->ca == "")
+                    if (info->ca)
                         hashSink = std::make_unique<HashSink>(info->narHash.type);
                     else
                         hashSink = std::make_unique<HashModuloSink>(info->narHash.type, storePathToHash(store->printStorePath(info->path)));