diff --git a/pkgs/build-support/dotnet/fetchnuget/default.nix b/pkgs/build-support/dotnet/fetchnuget/default.nix
index 061da746cead..a8e85270e73f 100644
--- a/pkgs/build-support/dotnet/fetchnuget/default.nix
+++ b/pkgs/build-support/dotnet/fetchnuget/default.nix
@@ -5,15 +5,19 @@ attrs @
 , version
 , url ? "https://www.nuget.org/api/v2/package/${pname}/${version}"
 , sha256 ? ""
+, hash ? ""
 , md5 ? ""
 , ...
 }:
 if md5 != "" then
-  throw "fetchnuget does not support md5 anymore, please use sha256"
+  throw "fetchnuget does not support md5 anymore, please use 'hash' attribute with SRI hash"
+# This is also detected in fetchurl, but we just throw here to avoid confusion
+else if (sha256 != "" && hash != "") then
+  throw "multiple hashes passed to fetchNuGet"
 else
   buildDotnetPackage ({
     src = fetchurl {
-      inherit url sha256;
+      inherit url sha256 hash;
       name = "${pname}.${version}.zip";
     };