diff --git a/MODULE.bazel b/MODULE.bazel
index 57eb663..9122aaf 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -478,6 +478,27 @@
     lock_file = "//tests/custom_maven_install:maven_install.json",
 )
 dev_maven.install(
+    name = "multi_repo_hash",
+    artifacts = ["junit:junit:4.13.2"],
+    fail_if_repin_required = True,
+    lock_file = "//tests/custom_maven_install:multi_repo_hash_install.json",
+    repositories = [
+        "https://repo1.maven.org/maven2/",
+        "https://repo.maven.apache.org/maven2/",
+    ],
+    resolver = "maven",
+)
+dev_maven.install(
+    name = "legacy_multi_repo_hash",
+    artifacts = ["junit:junit:4.13.2"],
+    fail_if_repin_required = True,
+    lock_file = "//tests/custom_maven_install:legacy_multi_repo_hash_install.json",
+    repositories = [
+        "https://repo1.maven.org/maven2/",
+        "https://repo.maven.apache.org/maven2/",
+    ],
+)
+dev_maven.install(
     # This name matches the one in `tests/integration/bzlmod_lock_files`
     name = "multiple_lock_files",
     artifacts = ["org.zeromq:jeromq:0.5.4"],
@@ -1098,6 +1119,10 @@
     "unpinned_v1_lock_file_format",
     "v1_lock_file_format",
     "version_interval_testing",
+    "multi_repo_hash",
+    "unpinned_multi_repo_hash",
+    "legacy_multi_repo_hash",
+    "unpinned_legacy_multi_repo_hash",
 )
 
 http_file(
diff --git a/private/rules/coursier.bzl b/private/rules/coursier.bzl
index 78d623b..f1be5a6 100644
--- a/private/rules/coursier.bzl
+++ b/private/rules/coursier.bzl
@@ -684,7 +684,17 @@
     elif importer.compute_lock_file_hash(maven_install_json_content) != dep_tree_signature:
         # Then, validate that the signature provided matches the contents of the dependency_tree.
         # This is to stop users from manually modifying maven_install.json.
-        if _get_fail_if_repin_required(repository_ctx):
+        legacy_hash_fn = getattr(importer, "compute_lock_file_hash_legacy", None)
+        is_legacy_hash = legacy_hash_fn != None and legacy_hash_fn(maven_install_json_content) == dep_tree_signature
+        if is_legacy_hash:
+            # The lock file was written by an older version of rules_jvm_external that used
+            # repository insertion order when computing hashes. The file is valid but needs
+            # to be regenerated to use the current hash algorithm.
+            print(
+                "NOTE: %s_install.json was generated by an older version of rules_jvm_external " % user_provided_name +
+                "and needs to be regenerated. To update, run 'bazel run %s'." % pin_target,
+            )
+        elif _get_fail_if_repin_required(repository_ctx):
             computed_hash = importer.compute_lock_file_hash(maven_install_json_content)
             to_print = importer.print_friendly_hash_difference(dep_tree_signature, computed_hash)
             fail(
diff --git a/private/rules/v3_lock_file.bzl b/private/rules/v3_lock_file.bzl
index 43b4369..7ec4123 100644
--- a/private/rules/v3_lock_file.bzl
+++ b/private/rules/v3_lock_file.bzl
@@ -131,7 +131,7 @@
 
     return final_hashes
 
-def _compute_lock_file_hash_v3(lock_file_contents):
+def _compute_lock_file_hash_v3_impl(lock_file_contents, repo_keys):
     all_infos = dict()
 
     for dep, dep_info in lock_file_contents["artifacts"].items():
@@ -149,8 +149,8 @@
             type_info["sha"] = sha
             all_infos[dep + suffix] = type_info
 
-    for repo, artifacts in lock_file_contents["repositories"].items():
-        for artifact in artifacts:
+    for repo in repo_keys:
+        for artifact in lock_file_contents["repositories"][repo]:
             all_infos[artifact]["repository"] = repo
 
     for dep, dep_info in lock_file_contents["dependencies"].items():
@@ -158,6 +158,26 @@
 
     return _compute_final_hash(all_infos)
 
+def _compute_lock_file_hash_v3(lock_file_contents):
+    # Sort repositories to match the order used by the Java resolver binary (AbstractMain.calculateArtifactHash
+    # uses sortMapRecursively which sorts alphabetically). Without sorting, artifacts present in
+    # multiple repositories get different "repository" values depending on iteration order, causing
+    # hash mismatches between the stored value (written by Java) and the value computed here.
+    return _compute_lock_file_hash_v3_impl(
+        lock_file_contents,
+        sorted(lock_file_contents["repositories"].keys()),
+    )
+
+def _compute_lock_file_hash_v3_legacy(lock_file_contents):
+    # Computes the hash using repository insertion order. Used to detect lock
+    # files written by older versions of rules_jvm_external (before the fix
+    # that aligned Starlark hash order with the Java resolver). If the current
+    # hash does not match but this one does, the file needs to be repinned.
+    return _compute_lock_file_hash_v3_impl(
+        lock_file_contents,
+        lock_file_contents["repositories"].keys(),
+    )
+
 def _to_m2_path(unpacked):
     path = "{group}/{artifact}/{version}/{artifact}-{version}".format(
         artifact = unpacked["artifact"],
@@ -329,6 +349,7 @@
     get_lock_file_hash = _get_lock_file_hash,
     print_friendly_hash_difference = _print_friendly_hash_difference_v3,
     compute_lock_file_hash = _compute_lock_file_hash_v3,
+    compute_lock_file_hash_legacy = _compute_lock_file_hash_v3_legacy,
     get_artifacts = _get_artifacts,
     get_netrc_entries = _get_netrc_entries,
     render_lock_file = _render_lock_file,
diff --git a/tests/bazel_run_tests.sh b/tests/bazel_run_tests.sh
index dc13e73..c6bc81e 100755
--- a/tests/bazel_run_tests.sh
+++ b/tests/bazel_run_tests.sh
@@ -369,6 +369,19 @@
   bazel build @from_files//:all
 }
 
+function test_hash_verification_stable_for_artifact_in_multiple_repos() {
+  force_bzlmod_lock_file_to_be_regenerated
+
+  bazel build @multi_repo_hash//:junit_junit >> "$TEST_LOG" 2>&1
+}
+
+function test_legacy_multi_repo_hash_accepted_by_fallback() {
+  force_bzlmod_lock_file_to_be_regenerated
+
+  bazel build @legacy_multi_repo_hash//:junit_junit >> "$TEST_LOG" 2>&1
+  expect_log "NOTE: legacy_multi_repo_hash_install.json was generated by an older version of rules_jvm_external"
+}
+
 TESTS=(
   "test_coursier_resolution_with_boms"
   "test_maven_resolution"
@@ -396,6 +409,8 @@
   # "test_gradle_metadata_is_resolved_correctly_for_aar_artifact"
   "test_gradle_metadata_is_resolved_correctly_for_jvm_artifact"
   "test_gradle_versions_catalog"
+  "test_hash_verification_stable_for_artifact_in_multiple_repos"
+  "test_legacy_multi_repo_hash_accepted_by_fallback"
 )
 
 function run_tests() {
diff --git a/tests/custom_maven_install/legacy_multi_repo_hash_install.json b/tests/custom_maven_install/legacy_multi_repo_hash_install.json
new file mode 100644
index 0000000..86b8a29
--- /dev/null
+++ b/tests/custom_maven_install/legacy_multi_repo_hash_install.json
@@ -0,0 +1,83 @@
+{
+  "__AUTOGENERATED_FILE_DO_NOT_MODIFY_THIS_FILE_MANUALLY": "THERE_IS_NO_DATA_ONLY_ZUUL",
+  "__INPUT_ARTIFACTS_HASH": {
+    "junit:junit": -744267592,
+    "repositories": 1879491525
+  },
+  "__RESOLVED_ARTIFACTS_HASH": {
+    "junit:junit": 712711302,
+    "org.hamcrest:hamcrest-core": 866476646
+  },
+  "artifacts": {
+    "junit:junit": {
+      "shasums": {
+        "jar": "8e495b634469d64fb8acfa3495a065cbacc8a0fff55ce1e31007be4c16dc57d3"
+      },
+      "version": "4.13.2"
+    },
+    "org.hamcrest:hamcrest-core": {
+      "shasums": {
+        "jar": "66fdef91e9739348df7a096aa384a5685f4e875584cce89386a7a47251c4d8e9"
+      },
+      "version": "1.3"
+    }
+  },
+  "dependencies": {
+    "junit:junit": [
+      "org.hamcrest:hamcrest-core"
+    ]
+  },
+  "packages": {
+    "junit:junit": [
+      "junit.extensions",
+      "junit.framework",
+      "junit.runner",
+      "junit.textui",
+      "org.junit",
+      "org.junit.experimental",
+      "org.junit.experimental.categories",
+      "org.junit.experimental.max",
+      "org.junit.experimental.results",
+      "org.junit.experimental.runners",
+      "org.junit.experimental.theories",
+      "org.junit.experimental.theories.internal",
+      "org.junit.experimental.theories.suppliers",
+      "org.junit.function",
+      "org.junit.internal",
+      "org.junit.internal.builders",
+      "org.junit.internal.management",
+      "org.junit.internal.matchers",
+      "org.junit.internal.requests",
+      "org.junit.internal.runners",
+      "org.junit.internal.runners.model",
+      "org.junit.internal.runners.rules",
+      "org.junit.internal.runners.statements",
+      "org.junit.matchers",
+      "org.junit.rules",
+      "org.junit.runner",
+      "org.junit.runner.manipulation",
+      "org.junit.runner.notification",
+      "org.junit.runners",
+      "org.junit.runners.model",
+      "org.junit.runners.parameterized",
+      "org.junit.validator"
+    ],
+    "org.hamcrest:hamcrest-core": [
+      "org.hamcrest",
+      "org.hamcrest.core",
+      "org.hamcrest.internal"
+    ]
+  },
+  "repositories": {
+    "https://repo1.maven.org/maven2/": [
+      "junit:junit",
+      "org.hamcrest:hamcrest-core"
+    ],
+    "https://repo.maven.apache.org/maven2/": [
+      "junit:junit",
+      "org.hamcrest:hamcrest-core"
+    ]
+  },
+  "services": {},
+  "version": "3"
+}
diff --git a/tests/custom_maven_install/multi_repo_hash_install.json b/tests/custom_maven_install/multi_repo_hash_install.json
new file mode 100644
index 0000000..cd2dabf
--- /dev/null
+++ b/tests/custom_maven_install/multi_repo_hash_install.json
@@ -0,0 +1,84 @@
+{
+  "__AUTOGENERATED_FILE_DO_NOT_MODIFY_THIS_FILE_MANUALLY": "THERE_IS_NO_DATA_ONLY_ZUUL",
+  "__INPUT_ARTIFACTS_HASH": {
+    "junit:junit": -744267592,
+    "repositories": 1879491525
+  },
+  "__RESOLVED_ARTIFACTS_HASH": {
+    "junit:junit": -1256429642,
+    "org.hamcrest:hamcrest-core": 649657847
+  },
+  "artifacts": {
+    "junit:junit": {
+      "shasums": {
+        "jar": "8e495b634469d64fb8acfa3495a065cbacc8a0fff55ce1e31007be4c16dc57d3"
+      },
+      "version": "4.13.2"
+    },
+    "org.hamcrest:hamcrest-core": {
+      "shasums": {
+        "jar": "66fdef91e9739348df7a096aa384a5685f4e875584cce89386a7a47251c4d8e9"
+      },
+      "version": "1.3"
+    }
+  },
+  "dependencies": {
+    "junit:junit": [
+      "org.hamcrest:hamcrest-core"
+    ]
+  },
+  "packages": {
+    "junit:junit": [
+      "junit.extensions",
+      "junit.framework",
+      "junit.runner",
+      "junit.textui",
+      "org.junit",
+      "org.junit.experimental",
+      "org.junit.experimental.categories",
+      "org.junit.experimental.max",
+      "org.junit.experimental.results",
+      "org.junit.experimental.runners",
+      "org.junit.experimental.theories",
+      "org.junit.experimental.theories.internal",
+      "org.junit.experimental.theories.suppliers",
+      "org.junit.function",
+      "org.junit.internal",
+      "org.junit.internal.builders",
+      "org.junit.internal.management",
+      "org.junit.internal.matchers",
+      "org.junit.internal.requests",
+      "org.junit.internal.runners",
+      "org.junit.internal.runners.model",
+      "org.junit.internal.runners.rules",
+      "org.junit.internal.runners.statements",
+      "org.junit.matchers",
+      "org.junit.rules",
+      "org.junit.runner",
+      "org.junit.runner.manipulation",
+      "org.junit.runner.notification",
+      "org.junit.runners",
+      "org.junit.runners.model",
+      "org.junit.runners.parameterized",
+      "org.junit.validator"
+    ],
+    "org.hamcrest:hamcrest-core": [
+      "org.hamcrest",
+      "org.hamcrest.core",
+      "org.hamcrest.internal"
+    ]
+  },
+  "repositories": {
+    "https://repo1.maven.org/maven2/": [
+      "junit:junit",
+      "org.hamcrest:hamcrest-core"
+    ],
+    "https://repo.maven.apache.org/maven2/": [
+      "junit:junit",
+      "org.hamcrest:hamcrest-core"
+    ]
+  },
+  "services": {},
+  "skipped": [],
+  "version": "3"
+}