diff --git a/fdroidserver/index.py b/fdroidserver/index.py
index 3482f15c..b63729e4 100644
--- a/fdroidserver/index.py
+++ b/fdroidserver/index.py
@@ -595,7 +595,10 @@ def convert_version(version, app, repodir):
         ver["file"]["ipfsCIDv1"] = ipfsCIDv1
 
     if "srcname" in version:
-        ver["src"] = common.file_entry(os.path.join(repodir, version["srcname"]))
+        ver["src"] = common.file_entry(
+            os.path.join(repodir, version["srcname"]),
+            version["srcnameSha256"],
+        )
 
     if "obbMainFile" in version:
         ver["obbMainFile"] = common.file_entry(
@@ -964,7 +967,7 @@ def make_v1(apps, packages, repodir, repodict, requestsdict, signer_fingerprints
         for k, v in sorted(package.items()):
             if not v:
                 continue
-            if k in ('icon', 'icons', 'icons_src', 'ipfsCIDv1', 'name'):
+            if k in ('icon', 'icons', 'icons_src', 'ipfsCIDv1', 'name', 'srcnameSha256'):
                 continue
             if k == 'antiFeatures':
                 d[k] = sorted(v.keys())
diff --git a/fdroidserver/update.py b/fdroidserver/update.py
index 6af82ab2..cb141007 100644
--- a/fdroidserver/update.py
+++ b/fdroidserver/update.py
@@ -370,6 +370,11 @@ def get_cache():
                 v['antiFeatures'] = {k: {} for k in sorted(v['antiFeatures'])}
         if 'added' in v:
             v['added'] = datetime.fromtimestamp(v['added'], tz=timezone.utc)
+        if v.get('srcname') and not v.get('srcnameSha256'):
+            f = f'archive/{v["srcname"]}'
+            if not os.path.exists(f):
+                f = f'repo/{v["srcname"]}'
+            v['srcnameSha256'] = common.sha256sum(f)
 
     return apkcache
 
@@ -1570,8 +1575,10 @@ def scan_repo_files(apkcache, repodir, knownapks, use_date_from_file=False):
                 repo_file['packageName'] = m.group(1)
                 repo_file['versionCode'] = int(m.group(2))
             srcfilename = name + b'_src.tar.gz'
-            if os.path.exists(os.path.join(repodir, srcfilename)):
+            srcpath = os.path.join(repodir, srcfilename)
+            if os.path.exists(srcpath):
                 repo_file['srcname'] = srcfilename.decode()
+                repo_file['srcnameSha256'] = common.sha256sum(srcpath.decode())
             repo_file['size'] = stat.st_size
 
             apkcache[name_utf8] = repo_file
@@ -1989,8 +1996,10 @@ def process_apk(apkcache, apkfilename, repodir, knownapks, use_date_from_apk=Fal
 
         apk['apkName'] = apkfilename
         srcfilename = apkfilename[:-4] + "_src.tar.gz"
-        if os.path.exists(os.path.join(repodir, srcfilename)):
+        srcpath = os.path.join(repodir, srcfilename)
+        if os.path.exists(srcpath):
             apk['srcname'] = srcfilename
+            apk['srcnameSha256'] = common.sha256sum(srcpath)
 
         # verify the jar signature is correct, allow deprecated
         # algorithms only if the APK is in the archive.