diff --git a/src/Package/Fetch.zig b/src/Package/Fetch.zig
index 3aae5a533fc3..9fe7f693fcec 100644
--- a/src/Package/Fetch.zig
+++ b/src/Package/Fetch.zig
@@ -257,8 +257,9 @@ pub fn run(f: *Fetch) RunError!void {
                 f.hash_tok,
                 try eb.addString("path-based dependencies are not hashed"),
             );
-            if (std.mem.startsWith(u8, pkg_root.sub_path, "../") or
-                std.mem.eql(u8, pkg_root.sub_path, ".."))
+            if ((std.mem.startsWith(u8, pkg_root.sub_path, "../") or
+                std.mem.eql(u8, pkg_root.sub_path, "..")) and
+                pkg_root.root_dir.eql(cache_root))
             {
                 return f.fail(
                     f.location_tok,