diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index afbb90d43d0..74ea1f5a9c5 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -4,4 +4,12 @@ header "downloading $out from $url"
 
 curl --fail --location --max-redirs 20 "$url" > "$out"
 
+if test "$NIX_OUTPUT_CHECKED" != "1"; then
+    actual=$(md5sum -b "$out" | cut -c1-32)
+    if test "$actual" != "$md5"; then
+        echo "hash is $actual, expected $md5"
+        exit 1
+    fi
+fi
+
 stopNest