diff --git a/README.md b/README.md
index 78eff92..734cd89 100644
--- a/README.md
+++ b/README.md
@@ -26,20 +26,18 @@ the AMI:
 ```nix
 {
   quixosEarlyBuildNixConfig = {
-    hosts = {
-      "2600:..." = [ "nix-cache.internal.example.org" ];
-    };
-    substituters = [ "http://nix-cache.internal.example.org/cache" ];
+    substituters = [ "http://[2600:...]/cache" ];
     trustedPublicKeys = [ "nix-cache.internal.example.org-1:..." ];
   };
 }
 ```
 
-The AMI runner evaluates this output after writing `/etc/nixos/flake.nix`,
-appends the host hints to `/etc/hosts`, and passes the substituters and trusted
-public keys through `NIX_CONFIG` only for the first `nixos-rebuild switch`.
-The target NixOS configuration should still declare the same cache in
-`nix.settings` for all later rebuilds.
+The AMI runner evaluates this output after writing `/etc/nixos/flake.nix` and
+passes the substituters and trusted public keys through `NIX_CONFIG` only for
+the first `nixos-rebuild switch`. It does not mutate `/etc/hosts`; first-boot
+substituters that need private addressing should use a direct address URL. The
+target NixOS configuration should still declare the normal hostname-based cache
+in `nix.settings` and `networking.hosts` for all later rebuilds.
 
 ## Publish
 
diff --git a/user-data.sh.tftpl b/user-data.sh.tftpl
index 68c0995..4a2bc22 100644
--- a/user-data.sh.tftpl
+++ b/user-data.sh.tftpl
@@ -110,13 +110,6 @@ write_config() {
               if nix --extra-experimental-features 'nix-command flakes' \
                 eval --json /etc/nixos#quixosEarlyBuildNixConfig \
                 > "$early_build_config" 2> "$early_build_error"; then
-                jq -r '(.hosts // {}) | to_entries[] | select(.key != "" and (.value | length > 0)) | [.key, (.value | join(" "))] | @tsv' "$early_build_config" |
-                  while IFS="$(printf '\t')" read -r address names; do
-                    if [ -n "$address" ] && [ -n "$names" ]; then
-                      printf '%s %s # quixos early build nix cache\n' "$address" "$names" >> /etc/hosts
-                    fi
-                  done
-
                 substituters="$(jq -r '(.substituters // []) | join(" ")' "$early_build_config")"
                 trusted_public_keys="$(jq -r '(.trustedPublicKeys // []) | join(" ")' "$early_build_config")"
                 if [ -n "$substituters" ]; then