diff --git a/src/libstore/download.cc b/src/libstore/download.cc
index 9a2d0dafa..c7cffedba 100644
--- a/src/libstore/download.cc
+++ b/src/libstore/download.cc
@@ -574,6 +574,11 @@ struct CurlDownloader : public Downloader
 
     void enqueueItem(std::shared_ptr<DownloadItem> item)
     {
+        if (item->request.data
+            && !hasPrefix(item->request.uri, "http://")
+            && !hasPrefix(item->request.uri, "https://"))
+            throw nix::Error("uploading to '%s' is not supported", item->request.uri);
+
         {
             auto state(state_.lock());
             if (state->quit)
diff --git a/tests/binary-cache.sh b/tests/binary-cache.sh
index 28b265686..cbcdca89b 100644
--- a/tests/binary-cache.sh
+++ b/tests/binary-cache.sh
@@ -52,9 +52,6 @@ export _NIX_FORCE_HTTP_BINARY_CACHE_STORE=1
 basicTests
 
 
-unset _NIX_FORCE_HTTP_BINARY_CACHE_STORE
-
-
 # Test whether Nix notices if the NAR doesn't match the hash in the NAR info.
 clearStore
 
@@ -86,11 +83,13 @@ clearStore
 nix-build --substituters "file://$cacheDir" dependencies.nix --dry-run # get info
 
 mkdir $cacheDir/tmp
-mv $cacheDir/*.nar* $cacheDir/tmp/
+mv $cacheDir/nar $cacheDir/nar2
 
-nix-build --substituters "file://$cacheDir" dependencies.nix -o $TEST_ROOT/result --fallback
+(! nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result)
 
-mv $cacheDir/tmp/* $cacheDir/
+nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result --fallback
+
+mv $cacheDir/nar2 $cacheDir/nar
 
 
 # Test whether building works if the binary cache contains an
@@ -107,6 +106,7 @@ if [ -n "$HAVE_SODIUM" ]; then
 
 # Create a signed binary cache.
 clearCache
+clearCacheCache
 
 declare -a res=($(nix-store --generate-binary-cache-key test.nixos.org-1 $TEST_ROOT/sk1 $TEST_ROOT/pk1 ))
 publicKey="$(cat $TEST_ROOT/pk1)"
@@ -117,7 +117,7 @@ badKey="$(cat $TEST_ROOT/pk2)"
 res=($(nix-store --generate-binary-cache-key foo.nixos.org-1 $TEST_ROOT/sk3 $TEST_ROOT/pk3))
 otherKey="$(cat $TEST_ROOT/pk3)"
 
-nix copy --to file://$cacheDir?secret-key=$TEST_ROOT/sk1 $outPath
+_NIX_FORCE_HTTP_BINARY_CACHE_STORE= nix copy --to file://$cacheDir?secret-key=$TEST_ROOT/sk1 $outPath
 
 
 # Downloading should fail if we don't provide a key.