diff --git a/src/config.js b/src/config.js
index 2fdf5ff162..10b6c9d8a0 100644
--- a/src/config.js
+++ b/src/config.js
@@ -17,6 +17,7 @@ import {registries, registryNames} from './registries/index.js';
 import {NoopReporter} from './reporters/index.js';
 import map from './util/map.js';
 
+const crypto = require('crypto');
 const detectIndent = require('detect-indent');
 const invariant = require('invariant');
 const path = require('path');
@@ -508,7 +509,7 @@ export default class Config {
       slug = `unknown-${slug}`;
     }
 
-    const {hash} = pkg.remote;
+    const {hash, integrity} = pkg.remote;
 
     if (pkg.version) {
       slug += `-${pkg.version}`;
@@ -520,6 +521,10 @@ export default class Config {
       slug += `-${hash}`;
     }
 
+    if (integrity != null) {
+      slug += `-${crypto.createHash('sha1').update(integrity).digest('hex')}`;
+    }
+
     return slug;
   }
 
diff --git a/src/lockfile/index.js b/src/lockfile/index.js
index ab6e9f970c..5926106dfb 100644
--- a/src/lockfile/index.js
+++ b/src/lockfile/index.js
@@ -179,7 +179,7 @@ export default class Lockfile {
       reporter.info(reporter.lang('noLockfileFound'));
     }
 
-    if (lockfile.__metadata) {
+    if (lockfile && lockfile.__metadata) {
       const lockfilev2 = lockfile;
       lockfile = {};
     }