diff --git a/master_changes.md b/master_changes.md
index 9a3a9217522..e1d1f404886 100644
--- a/master_changes.md
+++ b/master_changes.md
@@ -85,6 +85,7 @@ users)
   * When inferring a 2.1+ switch invariant from 2.0 base packages, don't filter out pinned packages as that causes very wide invariants for pinned compiler packages [#5176 @dra27 - fix #4501]
   * Really install invariant formula if not installed in switch [#5188 @rjbou]
   * On import, check that installed pinned packages changed, reinstall if so [#5181 @rjbou - fix #5173]
+  * [BUG] Enforce extra-source to have a checksum when using "opam switch export --freeze" [#5418 @kit-ty-kate]
 
 ## Config
   * Reset the "jobs" config variable when upgrading from opam 2.0 [#5284 @kit-ty-kate]
diff --git a/src/client/opamSwitchCommand.ml b/src/client/opamSwitchCommand.ml
index 452f338f0b3..ef3130da727 100644
--- a/src/client/opamSwitchCommand.ml
+++ b/src/client/opamSwitchCommand.ml
@@ -546,39 +546,49 @@ let import_t ?ask importfile t =
   end;
   t
 
-let freeze_opam src_dir nv opam =
-  match OpamFile.OPAM.url opam with
-  | None -> opam
-  | Some url ->
-    let url_t = OpamFile.URL.url url in
-    match url_t.backend with
-    | #OpamUrl.version_control ->
-      (match OpamProcess.Job.run
-               (OpamRepository.revision (src_dir nv) url_t) with
-      | None ->
-        OpamConsole.error_and_exit `Not_found
-          "Unable to retrieve %s url revision: %s, \
-           it can't be exported with --freeze."
-          (OpamPackage.to_string nv)
-          (OpamUrl.to_string url_t)
-      | Some hash ->
-        OpamFile.OPAM.with_url
-          (OpamFile.URL.with_url
-             { url_t with hash = Some (OpamPackage.Version.to_string hash) }
-             url)
-          opam)
-    | `http ->
-      (match OpamFile.URL.checksum url with
-       | [] ->
-         OpamConsole.error_and_exit `Not_found
-           "%s url doesn't have an associated checksum, \
-            it can't be exported with --freeze."
-           (OpamPackage.Name.to_string nv.name)
-       | _ -> opam)
-    | `rsync ->
+let freeze_url src_dir nv url =
+  let url_t = OpamFile.URL.url url in
+  match url_t.backend with
+  | #OpamUrl.version_control ->
+    (match OpamProcess.Job.run
+             (OpamRepository.revision (src_dir nv) url_t) with
+    | None ->
       OpamConsole.error_and_exit `Not_found
-        "%s is path pinned, it can't be exported with --freeze."
-        (OpamPackage.Name.to_string nv.name)
+        "Unable to retrieve %s url revision: %s, \
+         it can't be exported with --freeze."
+        (OpamPackage.to_string nv)
+        (OpamUrl.to_string url_t)
+    | Some hash ->
+      OpamFile.URL.with_url
+        { url_t with hash = Some (OpamPackage.Version.to_string hash) }
+        url)
+  | `http ->
+    (match OpamFile.URL.checksum url with
+     | [] ->
+       OpamConsole.error_and_exit `Not_found
+         "%s url doesn't have an associated checksum, \
+          it can't be exported with --freeze."
+         (OpamPackage.Name.to_string nv.name)
+     | _ -> url)
+  | `rsync ->
+    OpamConsole.error_and_exit `Not_found
+      "%s is path pinned, it can't be exported with --freeze."
+      (OpamPackage.Name.to_string nv.name)
+
+let freeze_opam src_dir nv opam =
+  let url =
+    OpamStd.Option.map
+      (fun url -> freeze_url src_dir nv url)
+      (OpamFile.OPAM.url opam)
+  in
+  let extra_sources =
+    List.map
+      (fun (name, url) -> (name, freeze_url src_dir nv url))
+      (OpamFile.OPAM.extra_sources opam)
+  in
+  opam |>
+  OpamFile.OPAM.with_url_opt url |>
+  OpamFile.OPAM.with_extra_sources extra_sources
 
 let export rt ?(freeze=false) ?(full=false)
     ?(switch=OpamStateConfig.get_switch ()) filename =
diff --git a/tests/reftests/switch-import.test b/tests/reftests/switch-import.test
index 4dcfd78fab8..aa507e38238 100644
--- a/tests/reftests/switch-import.test
+++ b/tests/reftests/switch-import.test
@@ -110,3 +110,98 @@ Done.
 nip.dev    git  git+file://${BASEDIR}/nip#snd-head
 ### opam list nip --installed --columns=name,installed-files --normalise --switch tierce | grep -v '^#'
 nip    ${BASEDIR}/OPAM/tierce/lib/snd.out
+### opam switch create test-switch-export-freeze --empty
+### opam switch export --freeze switch-freeze.export
+### opam-cat switch-freeze.export
+opam-version: "2.0"
+### <pkg:test.1>
+opam-version: "2.0"
+url {
+  src: "https://example.com/some/fake/url.tar.gz"
+  checksum: "md5=6aef5a674977ebc5ec853dc4f85cf2bb"
+}
+extra-source "file" {
+  src: "https://example.com/some/fake/extra/source"
+  checksum: "md5=6aef5a674977ebc5ec853dc4f85cf2bb"
+}
+### opam install --fake test.1
+The following actions will be faked:
+=== install 1 package
+  - install test 1
+
+<><> Processing actions <><><><><><><><><><><><><><><><><><><><><><><><><><><><>
+Faking installation of test.1
+Done.
+### opam switch export --freeze switch-freeze.export
+### opam-cat switch-freeze.export
+installed: ["test.1"]
+opam-version: "2.0"
+roots: ["test.1"]
+package "test" {
+opam-version: "2.0"
+version: "1"
+url {
+src: "https://example.com/some/fake/url.tar.gz"
+checksum: "md5=6aef5a674977ebc5ec853dc4f85cf2bb"
+}
+extra-source "file" {
+src: "https://example.com/some/fake/extra/source"
+checksum: "md5=6aef5a674977ebc5ec853dc4f85cf2bb"
+}
+}
+### <pkg:test.1>
+opam-version: "2.0"
+url {
+  src: "https://example.com/some/fake/url.tar.gz"
+}
+extra-source "file" {
+  src: "https://example.com/some/fake/extra/source"
+  checksum: "md5=6aef5a674977ebc5ec853dc4f85cf2bb"
+}
+### opam install --fake test.1
+The following actions will be faked:
+=== recompile 1 package
+  - recompile test 1
+
+<><> Processing actions <><><><><><><><><><><><><><><><><><><><><><><><><><><><>
+Faking installation of test.1
+Done.
+### opam switch export --freeze switch-freeze.export
+[ERROR] test url doesn't have an associated checksum, it can't be exported with --freeze.
+# Return code 5 #
+### <pkg:test.1>
+opam-version: "2.0"
+url {
+  src: "https://example.com/some/fake/url.tar.gz"
+  checksum: "md5=6aef5a674977ebc5ec853dc4f85cf2bb"
+}
+extra-source "file" {
+  src: "https://example.com/some/fake/extra/source"
+}
+### opam install --fake test.1
+The following actions will be faked:
+=== recompile 1 package
+  - recompile test 1
+
+<><> Processing actions <><><><><><><><><><><><><><><><><><><><><><><><><><><><>
+Faking installation of test.1
+Done.
+### opam switch export --freeze switch-freeze.export
+[ERROR] test url doesn't have an associated checksum, it can't be exported with --freeze.
+# Return code 5 #
+### opam-cat switch-freeze.export
+installed: ["test.1"]
+opam-version: "2.0"
+roots: ["test.1"]
+package "test" {
+opam-version: "2.0"
+version: "1"
+url {
+src: "https://example.com/some/fake/url.tar.gz"
+checksum: "md5=6aef5a674977ebc5ec853dc4f85cf2bb"
+}
+extra-source "file" {
+src: "https://example.com/some/fake/extra/source"
+checksum: "md5=6aef5a674977ebc5ec853dc4f85cf2bb"
+}
+}