diff --git a/src/Package.zig b/src/Package.zig
index 7f231f5ad7..2eb7321cee 100644
--- a/src/Package.zig
+++ b/src/Package.zig
@@ -66,10 +66,11 @@ pub const Hash = struct {
 
     pub fn toSlice(ph: *const Hash) []const u8 {
         var end: usize = ph.bytes.len;
-        while (true) {
+        while (end > 0) {
             end -= 1;
             if (ph.bytes[end] != 0) return ph.bytes[0 .. end + 1];
         }
+        return ph.bytes[0..0];
     }
 
     pub fn eql(a: *const Hash, b: *const Hash) bool {
@@ -195,6 +196,11 @@ test Hash {
     try std.testing.expectEqualStrings("nasm-2.16.1-3-vrr-ygAAoADH9XG3tOdvPNuHen_d-XeHndOG-nNXmved", result.toSlice());
 }
 
+test "empty hash" {
+    const hash = Hash.fromSlice("");
+    try std.testing.expectEqualStrings("", hash.toSlice());
+}
+
 test {
     _ = Fetch;
 }
diff --git a/src/Package/Fetch.zig b/src/Package/Fetch.zig
index 2e1d0c085f..305fb3b83c 100644
--- a/src/Package/Fetch.zig
+++ b/src/Package/Fetch.zig
@@ -568,14 +568,14 @@ fn runResource(
             const actual_hex = Package.multiHashHexDigest(f.computed_hash.digest);
             if (!std.mem.eql(u8, declared_hash.toSlice(), &actual_hex)) {
                 return f.fail(hash_tok, try eb.printString(
-                    "hash mismatch: manifest declares {s} but the fetched package has {s}",
+                    "hash mismatch: manifest declares '{s}' but the fetched package has '{s}'",
                     .{ declared_hash.toSlice(), actual_hex },
                 ));
             }
         } else {
             if (!computed_package_hash.eql(&declared_hash)) {
                 return f.fail(hash_tok, try eb.printString(
-                    "hash mismatch: manifest declares {s} but the fetched package has {s}",
+                    "hash mismatch: manifest declares '{s}' but the fetched package has '{s}'",
                     .{ declared_hash.toSlice(), computed_package_hash.toSlice() },
                 ));
             }
@@ -726,6 +726,7 @@ fn queueJobsForDeps(f: *Fetch) RunError!void {
                     .hash = h: {
                         const h = dep.hash orelse break :h null;
                         const pkg_hash: Package.Hash = .fromSlice(h);
+                        if (h.len == 0) break :h pkg_hash;
                         const gop = f.job_queue.table.getOrPutAssumeCapacity(pkg_hash);
                         if (gop.found_existing) {
                             if (!dep.lazy) {