diff --git a/package-managers/qubes-download-dom0-updates.sh b/package-managers/qubes-download-dom0-updates.sh
index d5c5b9304..d843c188c 100755
--- a/package-managers/qubes-download-dom0-updates.sh
+++ b/package-managers/qubes-download-dom0-updates.sh
@@ -13,6 +13,7 @@ elif [ -f "$DOM0_UPDATES_DIR/etc/yum.conf" ]; then
 fi
 # DNF uses /etc/yum.repos.d, even when --installroot is specified
 OPTS+=("--setopt=reposdir=$DOM0_UPDATES_DIR/etc/yum.repos.d")
+OPTS+=("--setopt=cachedir=$DOM0_UPDATES_DIR/var/cache/dnf")
 CLEAN_OPTS=("${OPTS[@]}")
 # DNF verifies signatures implicitly, but yumdownloader does not.
 SIGNATURE_REGEX=""
@@ -64,14 +65,6 @@ while [ -n "$1" ]; do
     shift
 done
 
-if [ -e /run/qubes-service/whonix-gateway ]; then
-    # DNF (or rather curl) refuses to resolve onion addresses directly, use
-    # socks proxy to avoid the issue
-    OPTS+=( --setopt=proxy=socks5h://127.0.0.1:9050/ )
-    # for stream isolation
-    OPTS+=( --setopt=proxy_username=dom0updates --setopt=proxy_password=dom0updates )
-fi
-
 if [ -z "$UPDATE_ACTION" ]; then
     UPDATE_ACTION=upgrade
 fi
diff --git a/qubes-rpc/qvm-template-repo-query b/qubes-rpc/qvm-template-repo-query
index 45293fe8e..e1447ece2 100644
--- a/qubes-rpc/qvm-template-repo-query
+++ b/qubes-rpc/qvm-template-repo-query
@@ -57,14 +57,6 @@ fi
 
 OPTS+=(-y "--setopt=reposdir=${repodir}" --quiet)
 
-if [ -e /run/qubes-service/whonix-gateway ]; then
-    # DNF (or rather curl) refuses to resolve onion addresses directly, use
-    # socks proxy to avoid the issue
-    OPTS+=( --setopt=proxy=socks5h://127.0.0.1:9050/ )
-    # for stream isolation
-    OPTS+=( --setopt=proxy_username=dom0updates --setopt=proxy_password=dom0updates )
-fi
-
 if ! $DNF5; then
     # use vendored 'downloadurl' dnf-plugin (fork of 'download' plugin), to print
     # all mirrors