@@ -215,10 +215,8 @@ def _get_links(self, package: Package) -> list[Link]:
         skipped = []
         locked_hash_names = {h.split(":")[0] for h in locked_hashes}
         for link in links:
-            if not link.hashes:
-                selected_links.append(link)
-                continue
-
+            # A link that advertises no hash is not trusted: the lock file requires
+            # a hash for this package, so fall through and compute one to compare.
             link_hash: str | None = None
             if (candidates := locked_hash_names.intersection(link.hashes.keys())) and (
                 hash_name := get_highest_priority_hash_type(candidates, link.filename)
 
@@ -787,7 +787,7 @@ def _download_link(self, operation: Install | Update, link: Link) -> Path:
         return archive
 
     def _populate_hashes_dict(self, archive: Path, package: Package) -> None:
-        if package.files and archive.name in {f["file"] for f in package.files}:
+        if package.files:
             archive_hash = self._validate_archive_hash(archive, package)
             self._hashes[package.name] = archive_hash
 
@@ -797,6 +797,14 @@ def _validate_archive_hash(archive: Path, package: Package) -> str:
         hash_types = {t.split(":")[0] for t in known_hashes}
         hash_type = get_highest_priority_hash_type(hash_types, archive.name)
 
+        if not known_hashes:
+            locked_files = sorted(f["file"] for f in package.files)
+            raise RuntimeError(
+                f"Downloaded archive {archive.name} for {package} is not listed in"
+                f" the lock file, so its hash cannot be verified"
+                f" (locked files: {locked_files})"
+            )
+
         if hash_type is None:
             raise RuntimeError(
                 f"No usable hash type(s) for {package} from archive"
 
@@ -10,13 +10,16 @@
 
 from poetry.console.exceptions import PoetryRuntimeError
 from poetry.installation.chooser import Chooser
+from poetry.core.packages.utils.link import Link
 from poetry.repositories.legacy_repository import LegacyRepository
 from poetry.utils.env import MockEnv
 
 
 if TYPE_CHECKING:
     from poetry.core.packages.package import PackageFile
 
+    from pytest_mock import MockerFixture
+
     from poetry.repositories.repository_pool import RepositoryPool
     from tests.conftest import Config
     from tests.types import DistributionHashGetter
@@ -323,6 +326,60 @@ def test_chooser_does_not_choose_yanked_if_others(
     assert link_partial_yank.filename == "futures-3.2.0.tar.gz"
 
 
+LOCKED_SHA = "sha256:" + "1" * 64
+OTHER_SHA = "sha256:" + "2" * 64
+
+
+def _hashless_package_and_pool(
+    pool: RepositoryPool, mocker: MockerFixture, computed: str
+) -> Package:
+    """Point the pool at a single link that advertises no hash at all, and make
+    the repository compute `computed` for it.
+    """
+    package = Package(
+        "isort",
+        "4.3.4",
+        source_type="legacy",
+        source_reference="foo",
+        source_url="https://legacy.foo.bar/simple/",
+    )
+    package.files = [{"file": "isort-4.3.4.tar.gz", "hash": LOCKED_SHA}]
+
+    hashless = Link("https://legacy.foo.bar/isort-4.3.4.tar.gz")
+    assert not hashless.hashes
+
+    mocker.patch.object(
+        LegacyRepository, "find_links_for_package", return_value=[hashless]
+    )
+    mocker.patch.object(LegacyRepository, "calculate_sha256", return_value=computed)
+    return package
+
+
+def test_chooser_rejects_a_hashless_link_whose_computed_hash_does_not_match(
+    env: MockEnv, pool: RepositoryPool, mocker: MockerFixture
+) -> None:
+    """An index that omits the hash fragment must not bypass the locked hashes."""
+    package = _hashless_package_and_pool(pool, mocker, OTHER_SHA)
+
+    with pytest.raises(PoetryRuntimeError) as e:
+        Chooser(pool, env).choose_for(package)
+
+    assert "did not match any known checksums" in str(e.value)
+
+
+def test_chooser_accepts_a_hashless_link_whose_computed_hash_matches(
+    env: MockEnv, pool: RepositoryPool, mocker: MockerFixture
+) -> None:
+    """Computing the hash is the point, so a hashless link that hashes to the
+    locked value is still installable.
+    """
+    package = _hashless_package_and_pool(pool, mocker, LOCKED_SHA)
+
+    link = Chooser(pool, env).choose_for(package)
+
+    assert link.filename == "isort-4.3.4.tar.gz"
+
+
 @pytest.mark.parametrize("source_type", ["", "legacy"])
 def test_chooser_throws_an_error_if_package_hashes_do_not_match(
     env: MockEnv,
 
@@ -1929,6 +1929,37 @@ def test_executor_known_hashes(
     verify_installed_distribution(tmp_venv, package, expected_url_reference)
 
 
+def test_executor_rejects_an_archive_not_listed_in_the_lock_file(
+    tmp_venv: VirtualEnv,
+    pool: RepositoryPool,
+    config: Config,
+    io: BufferedIO,
+    fixture_dir: FixtureDirGetter,
+) -> None:
+    """The served filename must not decide whether the hash is checked. A lock
+    file that pins hashes has to reject an archive it does not list.
+    """
+    url = (fixture_dir("distributions") / "demo-0.1.0.tar.gz").resolve()
+    package = Package("demo", "0.1.0", source_type="file", source_url=url.as_posix())
+    # The lock pins a hash, but under a filename the served archive does not use.
+    package.files = [
+        {
+            "file": "demo-0.1.0-py2.py3-none-any.whl",
+            "hash": "sha256:" + "0" * 64,
+        },
+    ]
+
+    executor = Executor(tmp_venv, pool, config, io)
+    return_code = executor.execute([Install(package)])
+
+    distributions = list(tmp_venv.site_packages.distributions(name=package.name))
+    assert len(distributions) == 0
+
+    output = io.fetch_output()
+    assert return_code == 1, f"\noutput: {output}\n"
+    assert "is not listed in the lock file" in output
+
+
 def test_executor_no_supported_hash_types(
     tmp_venv: VirtualEnv,
     pool: RepositoryPool,