diff --git a/python/make_sdist.sh b/python/make_sdist.sh
index 326cb23a..71cc5272 100755
--- a/python/make_sdist.sh
+++ b/python/make_sdist.sh
@@ -28,8 +28,8 @@ else
   readonly tmp_dir="$(mktemp -d)"
 fi
 
-python -m pip install --upgrade pip setuptools
-python -m pip install absl-py
+python -m pip install --upgrade --require-hashes \
+    -r ${package_dir}/make_sdist_requirements.txt
 pushd ${tmp_dir}
 cp -r "${package_dir}"/* .
 
diff --git a/python/make_sdist_requirements.txt b/python/make_sdist_requirements.txt
new file mode 100644
index 00000000..763fb174
--- /dev/null
+++ b/python/make_sdist_requirements.txt
@@ -0,0 +1,6 @@
+absl-py==1.3.0 \
+    --hash=sha256:34995df9bd7a09b3b8749e230408f5a2a2dd7a68a0d33c12a3d0cb15a041a507
+pip==22.3.1 \
+    --hash=sha256:908c78e6bc29b676ede1c4d57981d490cb892eb45cd8c214ab6298125119e077
+setuptools==65.5.1 \
+    --hash=sha256:d0b9a8433464d5800cbe05094acf5c6d52a91bfac9b52bcfc4d41382be5d5d31