diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index b3b975464..4e7d0ed3f 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -220,6 +220,25 @@ struct GitArchiveInputScheme : InputScheme
 
         auto accessor = makeZipInputAccessor(CanonPath(store->toRealPath(storePath)));
 
+        /* Compute the NAR hash of the contents of the zip file. This
+           is checked against the NAR hash in the lock file in
+           Input::checkLocks(). */
+        auto key = fmt("zip-nar-hash-%s", store->toRealPath(storePath.to_string()));
+
+        auto cache = getCache();
+
+        auto narHash = [&]() {
+            if (auto narHashS = cache->queryFact(key)) {
+                return Hash::parseSRI(*narHashS);
+            } else {
+                auto narHash = accessor->hashPath(CanonPath::root);
+                cache->upsertFact(key, narHash.to_string(SRI, true));
+                return narHash;
+            }
+        }();
+
+        input2.attrs.insert_or_assign("narHash", narHash.to_string(SRI, true));
+
         auto lastModified = accessor->getLastModified();
         assert(lastModified);
         input2.attrs.insert_or_assign("lastModified", uint64_t(*lastModified));
diff --git a/src/libfetchers/input-accessor.cc b/src/libfetchers/input-accessor.cc
index f42281ecc..369c43968 100644
--- a/src/libfetchers/input-accessor.cc
+++ b/src/libfetchers/input-accessor.cc
@@ -87,6 +87,16 @@ void InputAccessor::dumpPath(
     dump(path);
 }
 
+Hash InputAccessor::hashPath(
+    const CanonPath & path,
+    PathFilter & filter,
+    HashType ht)
+{
+    HashSink sink(ht);
+    dumpPath(path, sink, filter);
+    return sink.finish().first;
+}
+
 StorePath InputAccessor::fetchToStore(
     ref<Store> store,
     const CanonPath & path,
diff --git a/src/libfetchers/input-accessor.hh b/src/libfetchers/input-accessor.hh
index c1636b20b..854034949 100644
--- a/src/libfetchers/input-accessor.hh
+++ b/src/libfetchers/input-accessor.hh
@@ -5,6 +5,7 @@
 #include "archive.hh"
 #include "canon-path.hh"
 #include "repair-flag.hh"
+#include "hash.hh"
 
 namespace nix {
 
@@ -57,6 +58,11 @@ struct InputAccessor : public std::enable_shared_from_this<InputAccessor>
         Sink & sink,
         PathFilter & filter = defaultPathFilter);
 
+    Hash hashPath(
+        const CanonPath & path,
+        PathFilter & filter = defaultPathFilter,
+        HashType ht = htSHA256);
+
     StorePath fetchToStore(
         ref<Store> store,
         const CanonPath & path,