diff --git a/guix/scripts/substitute.scm b/guix/scripts/substitute.scm
index 2634161e72..b3a514815d 100755
--- a/guix/scripts/substitute.scm
+++ b/guix/scripts/substitute.scm
@@ -408,7 +408,8 @@ way to download the nar."
                               #:fast-decompression?
                               fast-decompression?
                               #:open-connection-for-uri
-                              open-connection-for-uri/cached))
+                              open-connection-for-uri/cached
+                              #:keep-alive? #t))
               (loop rest)))
          (()
           (loop rest)))))))
@@ -461,7 +462,8 @@ PORT."
                          #:print-build-trace? print-build-trace?
                          #:fast-decompression? fast-decompression?
                          #:open-connection-for-uri
-                         open-connection-for-uri/cached))))
+                         open-connection-for-uri/cached
+                         #:keep-alive? #t))))
     (values narinfo
             expected-hash
             actual-hash)))
diff --git a/guix/substitutes.scm b/guix/substitutes.scm
index 79c109e124..e1c6749757 100644
--- a/guix/substitutes.scm
+++ b/guix/substitutes.scm
@@ -467,7 +467,8 @@ again.  If DURATION is #f, run BODY with no timeout."
                        #:key deduplicate? print-build-trace?
                        (fetch-timeout %fetch-timeout)
                        fast-decompression?
-                       (open-connection-for-uri guix:open-connection-for-uri))
+                       (open-connection-for-uri guix:open-connection-for-uri)
+                       (keep-alive? #f))
   "Download the nar prescribed in NARINFO, which is assumed to be authentic
 and authorized, and write it to DESTINATION.  When DEDUPLICATE? is true, and
 if DESTINATION is in the store, deduplicate its files.  Use
@@ -513,7 +514,7 @@ OPEN-CONNECTION-FOR-URI to open connections."
                     response
                     (http-fetch uri #:text? #f
                                 #:port port
-                                #:keep-alive? #t
+                                #:keep-alive? keep-alive?
                                 #:buffered? #f)))
                (values port
                        (response-content-length response)))))))
@@ -596,6 +597,12 @@ OPEN-CONNECTION-FOR-URI to open connections."
       ;; Wait for the reporter to finish.
       (every (compose zero? cdr waitpid) pids)
 
+      ;; TODO The port should also be closed if the relevant HTTP response
+      ;; header is set, but http-fetch doesn't currently share that
+      ;; information
+      (unless keep-alive?
+        (close-port raw))
+
       (values expected
               (get-hash)))))