diff --git a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/BazelLockFileModule.java b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/BazelLockFileModule.java
index fd2bfddd42120a..a346f5981475ad 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/BazelLockFileModule.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/BazelLockFileModule.java
@@ -17,6 +17,7 @@
 import static java.nio.charset.StandardCharsets.UTF_8;
 
 import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.eventbus.Subscribe;
 import com.google.common.flogger.GoogleLogger;
 import com.google.devtools.build.lib.bazel.repository.RepositoryOptions;
@@ -123,7 +124,11 @@ private ImmutableMap<ModuleExtensionId, LockFileModuleExtension> combineModuleEx
     for (ModuleExtensionResolutionEvent extensionEvent : extensionResolutionEvents) {
       updatedExtensionMap.put(extensionEvent.getExtensionId(), extensionEvent.getModuleExtension());
     }
-    return updatedExtensionMap.buildKeepingLast();
+    // The order in which extensions are added to extensionResolutionEvents depends on the order
+    // in which their Skyframe evaluations finish, which is non-deterministic. We ensure a
+    // deterministic lockfile by sorting.
+    return ImmutableSortedMap.copyOf(
+        updatedExtensionMap.buildKeepingLast(), ModuleExtensionId.LEXICOGRAPHIC_COMPARATOR);
   }
 
   /**