diff --git a/pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh b/pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh
index a28b346dac84..18937c85c692 100644
--- a/pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh
+++ b/pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh
@@ -28,29 +28,27 @@ npmConfigHook() {
         exit 1
     fi
 
+    if [[ -e "$npmDeps/cache_version" ]]; then
+      local -r cacheVersion=$(cat "$npmDeps/cache_version")
+    else
+      local -r cacheVersion="1"
+    fi
+
     # Only run this in buildNpmPackage, this is just for a nicer error message; we trust that
     # people using the setup hook directly also know how FODs work. ;)
-    if [[ -n ${NIX_NPM_CACHE_VERSION+x} ]]; then
-      if [[ -e "$npmDeps/cache_version" ]]; then
-        local -r cacheVersion=$(cat "$npmDeps/cache_version")
-      else
-        local -r cacheVersion="1"
-      fi
+    if [[ -n ${NIX_NPM_CACHE_VERSION+x} ]] && [[ $NIX_NPM_CACHE_VERSION != $cacheVersion ]]; then
+      echo
+      echo "ERROR: npmDepsHash is out of date"
+      echo
+      echo "The cache version in the arguments to buildNpmPackage ($NIX_NPM_CACHE_VERSION) is not the same as the one in $npmDeps ($cacheVersion)."
+      echo
+      echo "To fix the issue:"
+      echo '1. Use `lib.fakeHash` as the npmDepsHash value'
+      echo "2. Build the derivation and wait for it to fail with a hash mismatch"
+      echo "3. Copy the 'got: sha256-' value back into the npmDepsHash field"
+      echo
 
-      if [[ $NIX_NPM_CACHE_VERSION != $cacheVersion ]]; then
-        echo
-        echo "ERROR: npmDepsHash is out of date"
-        echo
-        echo "The cache version in the arguments to buildNpmPackage ($NIX_NPM_CACHE_VERSION) is not the same as the one in $npmDeps ($cacheVersion)."
-        echo
-        echo "To fix the issue:"
-        echo '1. Use `lib.fakeHash` as the npmDepsHash value'
-        echo "2. Build the derivation and wait for it to fail with a hash mismatch"
-        echo "3. Copy the 'got: sha256-' value back into the npmDepsHash field"
-        echo
-
-        exit 1
-      fi
+      exit 1
     fi
 
     local -r cacheLockfile="$npmDeps/package-lock.json"
@@ -103,7 +101,11 @@ npmConfigHook() {
 
     local cachePath
 
-    if [ -z "${makeCacheWritable-}" ]; then
+    # When a given cache key has multiple entries (which is the case with
+    # cache version 2), npm always needs to write to the cache.
+    #
+    # TODO(winter): report upstream?
+    if [ -z "${makeCacheWritable-}" ] && (( cacheVersion == 1 )); then
         cachePath="$npmDeps"
     else
         echo "Making cache writable"