diff --git a/include/host-build.mk b/include/host-build.mk
index 7d84ab0f5f..4ac1405181 100644
--- a/include/host-build.mk
+++ b/include/host-build.mk
@@ -186,6 +186,8 @@ ifndef DUMP
     clean-build: host-clean-build
   endif
 
+  $(DL_DIR)/$(FILE): FORCE
+
   $(_host_target)host-prepare: $(HOST_STAMP_PREPARED)
   $(_host_target)host-configure: $(HOST_STAMP_CONFIGURED)
   $(_host_target)host-compile: $(HOST_STAMP_BUILT) $(HOST_STAMP_INSTALLED)
diff --git a/include/package.mk b/include/package.mk
index 50bd838180..5eb4460db8 100644
--- a/include/package.mk
+++ b/include/package.mk
@@ -189,6 +189,8 @@ define Build/CoreTargets
   $(call Build/Autoclean)
   $(call DefaultTargets)
 
+  $(DL_DIR)/$(FILE): FORCE
+
   download:
 	$(foreach hook,$(Hooks/Download),
 		$(call $(hook))$(sep)
diff --git a/scripts/download.pl b/scripts/download.pl
index 351b06a08b..2d87f47f84 100755
--- a/scripts/download.pl
+++ b/scripts/download.pl
@@ -262,6 +262,24 @@ foreach my $mirror (@ARGV) {
 push @mirrors, 'https://sources.openwrt.org';
 push @mirrors, 'https://mirror2.openwrt.org/sources';
 
+if (-f "$target/$filename") {
+	$hash_cmd and do {
+		if (system("cat '$target/$filename' | $hash_cmd > '$target/$filename.hash'")) {
+			die "Failed to generate hash for $filename\n";
+		}
+
+		my $sum = `cat "$target/$filename.hash"`;
+		$sum =~ /^(\w+)\s*/ or die "Could not generate file hash\n";
+		$sum = $1;
+
+		exit 0 if $sum eq $file_hash;
+
+		die "Hash of the local file $filename does not match (file: $sum, requested: $file_hash) - deleting download.\n";
+		unlink "$target/$filename";
+		cleanup();
+	};
+}
+
 while (!-f "$target/$filename") {
 	my $mirror = shift @mirrors;
 	$mirror or die "No more mirrors to try - giving up.\n";