diff --git a/src/libfetchers/fetchers.cc b/src/libfetchers/fetchers.cc
index 9174c3de4..91d0d6a1d 100644
--- a/src/libfetchers/fetchers.cc
+++ b/src/libfetchers/fetchers.cc
@@ -35,8 +35,7 @@ std::unique_ptr<Input> inputFromAttrs(const Attrs & attrs)
         auto res = inputScheme->inputFromAttrs(attrs2);
         if (res) {
             if (auto narHash = maybeGetStrAttr(attrs, "narHash"))
-                // FIXME: require SRI hash.
-                res->narHash = newHashAllowEmpty(*narHash, {});
+                res->narHash = Hash::fromSRI(*narHash);
             return res;
         }
     }
diff --git a/src/libfetchers/tarball.cc b/src/libfetchers/tarball.cc
index f5356f0af..732fac8c3 100644
--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@@ -242,15 +242,13 @@ struct TarballInputScheme : InputScheme
 
         auto hash = input->url.query.find("hash");
         if (hash != input->url.query.end()) {
-            // FIXME: require SRI hash.
-            input->hash = Hash(hash->second);
+            input->hash = Hash::fromSRI(hash->second);
             input->url.query.erase(hash);
         }
 
         auto narHash = input->url.query.find("narHash");
         if (narHash != input->url.query.end()) {
-            // FIXME: require SRI hash.
-            input->narHash = Hash(narHash->second);
+            input->narHash = Hash::fromSRI(narHash->second);
             input->url.query.erase(narHash);
         }
 
diff --git a/src/libutil/hash.hh b/src/libutil/hash.hh
index 570e50dd4..887952ce5 100644
--- a/src/libutil/hash.hh
+++ b/src/libutil/hash.hh
@@ -43,7 +43,7 @@ struct Hash
     // hash type must be part of string
     Hash(std::string_view s);
 
-    Hash fromSRI(std::string_view original);
+    static Hash fromSRI(std::string_view original);
 
 private:
     // type must be provided, s must not include <type> prefix
diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index ed43c403f..ea28ee70d 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1,5 +1,6 @@
 #include "lazy.hh"
 #include "util.hh"
+#include "hash.hh"
 #include "affinity.hh"
 #include "sync.hh"
 #include "finally.hh"