diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index 99b02b497aee..b776585d1b43 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -192,6 +192,7 @@ def copy_closure(
             [
                 "nix",
                 "copy",
+                *dict_to_flags(copy_flags),
                 "--from",
                 f"ssh://{from_host.host}",
                 "--to",
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index d589b23ea4d0..d8bd5464aa76 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -237,9 +237,9 @@ def test_copy_closure(monkeypatch: Any) -> None:
 
     monkeypatch.setenv("NIX_SSHOPTS", "--ssh build-opt")
     with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
-        n.copy_closure(closure, None, build_host)
+        n.copy_closure(closure, None, build_host, copy_flag=True)
         mock_run.assert_called_with(
-            ["nix-copy-closure", "--from", "user@build.host", closure],
+            ["nix-copy-closure", "--copy-flag", "--from", "user@build.host", closure],
             extra_env={
                 "NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS + ["--ssh build-opt"])
             },
@@ -251,11 +251,12 @@ def test_copy_closure(monkeypatch: Any) -> None:
         "NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS + ["--ssh build-target-opt"])
     }
     with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
-        n.copy_closure(closure, target_host, build_host)
+        n.copy_closure(closure, target_host, build_host, copy_flag=True)
         mock_run.assert_called_with(
             [
                 "nix",
                 "copy",
+                "--copy-flag",
                 "--from",
                 "ssh://user@build.host",
                 "--to",