diff --git a/pkgs/build-support/node/fetch-yarn-deps/default.nix b/pkgs/build-support/node/fetch-yarn-deps/default.nix
index 29a76d3d9f3e..8d7c3af68cb9 100644
--- a/pkgs/build-support/node/fetch-yarn-deps/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/default.nix
@@ -13,6 +13,7 @@
   nodejs-slim,
   prefetch-yarn-deps,
   fixup-yarn-lock,
+  diffutils,
   yarn,
   makeSetupHook,
   cacert,
@@ -169,6 +170,11 @@ in
       yarn
       fixup-yarn-lock
     ];
+    substitutions = {
+      # Specify `diff` by abspath to ensure that the user's build
+      # inputs do not cause us to find the wrong binaries.
+      diff = "${diffutils}/bin/diff";
+    };
     meta = {
       description = "Install nodejs dependencies from an offline yarn cache produced by fetchYarnDeps";
     };
diff --git a/pkgs/build-support/node/fetch-yarn-deps/yarn-config-hook.sh b/pkgs/build-support/node/fetch-yarn-deps/yarn-config-hook.sh
index c7479ebd3920..1d81aad62e60 100644
--- a/pkgs/build-support/node/fetch-yarn-deps/yarn-config-hook.sh
+++ b/pkgs/build-support/node/fetch-yarn-deps/yarn-config-hook.sh
@@ -10,6 +10,46 @@ yarnConfigHook() {
         echo yarnConfigHook: No yarnOfflineCache or offlineCache were defined\! >&2
         exit 2
     fi
+
+    local -r cacheLockfile="$offlineCache/yarn.lock"
+    local -r srcLockfile="$PWD/yarn.lock"
+
+    echo "Validating consistency between $srcLockfile and $cacheLockfile"
+
+    if ! @diff@ "$srcLockfile" "$cacheLockfile"; then
+      # If the diff failed, first double-check that the file exists, so we can
+      # give a friendlier error msg.
+      if ! [ -e "$srcLockfile" ]; then
+        echo
+        echo "ERROR: Missing yarn.lock from src. Expected to find it at: $srcLockfile"
+        echo "Hint: You can copy a vendored yarn.lock file via postPatch."
+        echo
+
+        exit 1
+      fi
+
+      if ! [ -e "$cacheLockfile" ]; then
+        echo
+        echo "ERROR: Missing lockfile from cache. Expected to find it at: $cacheLockfile"
+        echo
+
+        exit 1
+      fi
+
+      echo
+      echo "ERROR: fetchYarnDeps hash is out of date"
+      echo
+      echo "The yarn.lock in src is not the same as the in $offlineCache."
+      echo
+      echo "To fix the issue:"
+      echo '1. Use `lib.fakeHash` as the fetchYarnDeps hash value'
+      echo "2. Build the derivation and wait for it to fail with a hash mismatch"
+      echo "3. Copy the 'got: sha256-' value back into the fetchYarnDeps hash field"
+      echo
+
+      exit 1
+    fi
+
     yarn config --offline set yarn-offline-mirror "$offlineCache"
     fixup-yarn-lock yarn.lock
     yarn install \