diff --git a/Makefile b/Makefile
index 7811eac..7751725 100644
--- a/Makefile
+++ b/Makefile
@@ -28,8 +28,6 @@ fuzz:
 	go test -fuzz=FuzzRemoveEntry -fuzztime=$(FUZZTIME) ./manifest/
 	go test -fuzz=FuzzRead -fuzztime=$(FUZZTIME) ./lock/
 	go test -fuzz=FuzzFormat -fuzztime=$(FUZZTIME) ./sniff/
-	go test -fuzz=FuzzParseSRI -fuzztime=$(FUZZTIME) ./integrity/
-	go test -fuzz=FuzzRoundTrip -fuzztime=$(FUZZTIME) ./integrity/
 	go test -fuzz=FuzzIsSticky -fuzztime=$(FUZZTIME) ./source/npm/
 	go test -fuzz=FuzzFindSignature -fuzztime=$(FUZZTIME) ./source/npm/
 	go test -fuzz=FuzzSafeOut -fuzztime=$(FUZZTIME) .
diff --git a/README.md b/README.md
index a408f44..d5e7282 100644
--- a/README.md
+++ b/README.md
@@ -171,7 +171,7 @@ assets:
 
 ## Lockfile
 
-`pin.lock` is a valid CycloneDX 1.6 SBOM. Each package becomes a `library` component with the registry tarball hash; each vendored file becomes a nested `file` component with its own SHA-384, the CDN URL, and pin-specific metadata under a `pin:` property namespace. Any CycloneDX consumer (Dependency-Track, GUAC, OSV-scanner, `git-pkgs sbom`) reads it directly. `serialNumber` and `metadata.timestamp` are deliberately omitted so re-runs are byte-stable and parallel branches don't conflict on the file.
+`pin.lock` is a valid CycloneDX 1.6 SBOM. Each package becomes a `library` component with the registry tarball hashes; each vendored file becomes a nested `file` component with its integrity hashes, the CDN URL, and pin-specific metadata under a `pin:` property namespace. New file entries use SHA-384. Any CycloneDX consumer (Dependency-Track, GUAC, OSV-scanner, `git-pkgs sbom`) reads it directly. `serialNumber` and `metadata.timestamp` are deliberately omitted so re-runs are byte-stable and parallel branches don't conflict on the file.
 
 The schema is in [docs/SPEC.md](docs/SPEC.md), the defences in [docs/SECURITY.md](docs/SECURITY.md), and the adversary-by-asset model in [docs/THREAT_MODEL.md](docs/THREAT_MODEL.md).
 
@@ -215,7 +215,7 @@ Source resolvers are pluggable by purl type. Register a new resolver for any pre
 c.RegisterResolver("ipfs", myIPFSResolver{})
 ```
 
-The full Client surface: `Sync`, `Verify`, `Outdated`, `Add`, `Remove`, plus the package-level `List`, `Path`, `Init`, `SBOM`, `EncodeLock`. The `manifest`, `lock`, `pinfs`, `integrity`, `cdn`, `sniff`, `source` (with `source/npm`, `source/forge`, `source/rawurl`), and `assets` sub-packages are all public.
+The full Client surface: `Sync`, `Verify`, `Outdated`, `Add`, `Remove`, plus the package-level `List`, `Path`, `Init`, `SBOM`, `EncodeLock`. The `manifest`, `lock`, `pinfs`, `cdn`, `sniff`, `source` (with `source/npm`, `source/forge`, `source/rawurl`), and `assets` sub-packages are all public.
 
 `SyncOptions.FS` redirects pin's outputs (vendored files + `pin.lock`) into anything that implements `pinfs.Writer`. The default writes to local paths under `SyncOptions.Dir`; `pinfs.NewMemory()` keeps everything in process, and a custom implementation can pipe writes into a tarball, an archive, or an in-memory build artefact.
 
diff --git a/docs/SPEC.md b/docs/SPEC.md
index ce4221e..f68066f 100644
--- a/docs/SPEC.md
+++ b/docs/SPEC.md
@@ -96,12 +96,14 @@ order is stable and a writer MUST produce it; a reader MAY rely on it.
 
 - `bom-ref` equals `purl`. Both fields exist for CycloneDX consumers
   that key by either.
-- `hashes[0]` is the package-level integrity anchor. Encoding depends
-  on the source kind, summarised below:
+- `hashes[]` contains the package-level integrity anchors. npm metadata may
+  contain several supported SRI digests; pin preserves each SHA-256, SHA-384,
+  and SHA-512 entry in source order. Other source kinds use one entry. Encoding
+  depends on the source kind, summarised below:
 
-  | Source            | purl prefix     | `hashes[0].alg`          | `hashes[0].content`                            |
+  | Source            | purl prefix     | `hashes[].alg`            | `hashes[].content`                              |
   |-------------------|-----------------|--------------------------|------------------------------------------------|
-  | npm               | `pkg:npm/`      | `SHA-512` (or the algorithm in `dist.integrity`) | hex of the registry tarball                     |
+  | npm               | `pkg:npm/`      | each supported algorithm in `dist.integrity` | hex of the registry tarball                     |
   | github            | `pkg:github/`   | `SHA-1`                  | hex of the resolved commit SHA                  |
   | url (TOFU)        | `pkg:generic/`  | `SHA-384`                | hex of the single fetched file                  |
 
@@ -145,11 +147,11 @@ commit SHA; writers MUST write both.
   identifying the file inside the package.
 - `name` is the file's path inside the package (the source-of-record path,
   not the on-disk output path).
-- `hashes[0]` is the Subresource Integrity hash of the file's bytes,
-  encoded as hex per CycloneDX convention. SHA-384 is the default
-  algorithm chosen because it's what browsers accept in
-  `<script integrity>` attributes and what jsdelivr publishes natively.
-  Convert hex to base64 to produce an `sha384-...` SRI string.
+- `hashes[]` contains the Subresource Integrity digests of the file's bytes,
+  encoded as hex per CycloneDX convention. Readers preserve supported entries
+  in their original order. New file entries use SHA-384 because browsers accept
+  it in `<script integrity>` attributes and jsdelivr publishes it natively.
+  Convert each hex value to base64 to produce an SRI metadata list.
 - `externalReferences[type=distribution]` is the CDN URL where the file
   can be fetched. Recording it as transport metadata; integrity is
   anchored to the package, not the CDN.
diff --git a/docs/schema/pin.lock.schema.json b/docs/schema/pin.lock.schema.json
index a84d726..5bb89e1 100644
--- a/docs/schema/pin.lock.schema.json
+++ b/docs/schema/pin.lock.schema.json
@@ -75,7 +75,7 @@
         },
         "hashes": {
           "type": "array",
-          "description": "Package-level integrity anchor. SHA-512 for npm (tarball hash); SHA-1 for github (commit SHA, hex); SHA-384 for url (per-file TOFU).",
+          "description": "Package-level integrity anchors. npm may carry multiple SHA-256, SHA-384, or SHA-512 tarball hashes; github uses SHA-1 for the commit; url uses SHA-384 for per-file TOFU.",
           "items": { "$ref": "#/$defs/hash" }
         },
         "licenses": {
@@ -127,7 +127,7 @@
         "hashes": {
           "type": "array",
           "minItems": 1,
-          "description": "Per-file Subresource Integrity hash, hex-encoded. SHA-384 by default.",
+          "description": "Per-file Subresource Integrity hashes, hex-encoded. New entries use SHA-384 by default.",
           "items": { "$ref": "#/$defs/hash" }
         },
         "externalReferences": {
diff --git a/go.mod b/go.mod
index d5a8e5d..64693c0 100644
--- a/go.mod
+++ b/go.mod
@@ -6,6 +6,7 @@ require (
 	github.com/git-pkgs/archives v0.5.0
 	github.com/git-pkgs/attestation v0.1.0
 	github.com/git-pkgs/cooldown v0.1.1
+	github.com/git-pkgs/integrity v0.1.1
 	github.com/git-pkgs/purl v0.1.15
 	github.com/git-pkgs/registries v0.6.4
 	github.com/git-pkgs/sbom v0.1.3
diff --git a/go.sum b/go.sum
index 0a6db74..9146a38 100644
--- a/go.sum
+++ b/go.sum
@@ -232,6 +232,8 @@ github.com/git-pkgs/attestation v0.1.0 h1:aj10Ls05zHWPL7114r0Se8RKC/w8tJgfnzh3dU
 github.com/git-pkgs/attestation v0.1.0/go.mod h1:NSctZpcwmxCiTQ6z3b4X6SCT2N7fQtuPXvizkRgPgBU=
 github.com/git-pkgs/cooldown v0.1.1 h1:9OqqzCB8gANz/y44SmqGD0Jp8Qtu81D1sCbKl6Ehg7w=
 github.com/git-pkgs/cooldown v0.1.1/go.mod h1:v7APuK/UouTiu8mWQZbdDmj7DfxxkGUeuhjaRB5gv9E=
+github.com/git-pkgs/integrity v0.1.1 h1:nHQ7SktOiGM1dOb5BFnkdtttG/6FCgE6r5ru6QnsGts=
+github.com/git-pkgs/integrity v0.1.1/go.mod h1:hxu24lcd230377hCF28JQW7sGcCbuNLqo/0ULeb+F1Q=
 github.com/git-pkgs/magic v0.1.0 h1:xLrqq7CMXB9g5bJnmJyKw17Rvlh0GFiEmO6e5RFsoeY=
 github.com/git-pkgs/magic v0.1.0/go.mod h1:3ndidt+yvFaI1M0aEkkzkOlFnLPkeVQASIUojazcxCI=
 github.com/git-pkgs/pom v0.1.5 h1:TGT8Az2OMxGWsXnSagtUMGzZm7Oax8HrSCteA+mi0qY=
diff --git a/integrity/bench_test.go b/integrity/bench_test.go
deleted file mode 100644
index 7f430c5..0000000
--- a/integrity/bench_test.go
+++ /dev/null
@@ -1,21 +0,0 @@
-package integrity
-
-import "testing"
-
-const benchSRI = "sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
-
-func BenchmarkParseSRI(b *testing.B) {
-	b.ReportAllocs()
-	for b.Loop() {
-		_, _, _ = ParseSRI(benchSRI)
-	}
-}
-
-func BenchmarkFormatSRI(b *testing.B) {
-	_, hex, _ := ParseSRI(benchSRI)
-	b.ReportAllocs()
-	b.ResetTimer()
-	for b.Loop() {
-		_, _ = FormatSRI("SHA-384", hex)
-	}
-}
diff --git a/integrity/fuzz_test.go b/integrity/fuzz_test.go
deleted file mode 100644
index b85af5c..0000000
--- a/integrity/fuzz_test.go
+++ /dev/null
@@ -1,58 +0,0 @@
-package integrity
-
-import (
-	"strings"
-	"testing"
-)
-
-// FuzzParseSRI exercises the SRI string parser. ParseSRI runs strings.Cut
-// then a map lookup then base64.StdEncoding.DecodeString — each step
-// could panic or misbehave on malformed input. Contract: never panics,
-// and when err is nil the returned alg is one of the three CycloneDX
-// algorithm names.
-func FuzzParseSRI(f *testing.F) {
-	f.Add("")
-	f.Add("-")
-	f.Add("sha384-")
-	f.Add("sha384")
-	f.Add("sha384-aGVsbG8=") // valid: "hello"
-	f.Add("SHA384-aGVsbG8=") // mixed case prefix
-	f.Add("sha384-!!!!")     // bad base64
-	f.Add("md5-aGVsbG8=")    // unsupported alg
-	f.Add(strings.Repeat("sha384-", 100) + "aGVsbG8=")
-
-	validAlgs := map[string]bool{CDXSHA256: true, CDXSHA384: true, CDXSHA512: true}
-	f.Fuzz(func(t *testing.T, s string) {
-		alg, _, err := ParseSRI(s)
-		if err == nil && !validAlgs[alg] {
-			t.Errorf("ParseSRI(%q) returned alg %q with nil error; want one of SHA-256/384/512", s, alg)
-		}
-	})
-}
-
-// FuzzRoundTrip covers FormatSRI ∘ ParseSRI. Anything ParseSRI accepts
-// should round-trip through FormatSRI and parse again identically.
-func FuzzRoundTrip(f *testing.F) {
-	f.Add("sha384-aGVsbG8=")
-	f.Add("sha256-aGVsbG8=")
-	f.Add("sha512-AAAA")
-	f.Add("SHA384-aGVsbG8=")
-
-	f.Fuzz(func(t *testing.T, s string) {
-		alg, digest, err := ParseSRI(s)
-		if err != nil {
-			return
-		}
-		out, err := FormatSRI(alg, digest)
-		if err != nil {
-			t.Fatalf("FormatSRI failed after ParseSRI(%q) accepted: %v", s, err)
-		}
-		alg2, digest2, err := ParseSRI(out)
-		if err != nil {
-			t.Fatalf("re-parse of round-tripped %q failed: %v", out, err)
-		}
-		if alg2 != alg || digest2 != digest {
-			t.Errorf("round-trip drifted: in=(%q,%q) out=(%q,%q)", alg, digest, alg2, digest2)
-		}
-	})
-}
diff --git a/integrity/sri.go b/integrity/sri.go
deleted file mode 100644
index 12a4e3c..0000000
--- a/integrity/sri.go
+++ /dev/null
@@ -1,60 +0,0 @@
-// Package integrity provides Subresource Integrity helpers.
-package integrity
-
-import (
-	"encoding/base64"
-	"encoding/hex"
-	"fmt"
-	"strings"
-)
-
-// CycloneDX hash-algorithm names, the mirror of the SRI algorithm
-// prefixes (sha256/384/512).
-const (
-	CDXSHA256 = "SHA-256"
-	CDXSHA384 = "SHA-384"
-	CDXSHA512 = "SHA-512"
-)
-
-var sriAlgToCDX = map[string]string{
-	"sha256": CDXSHA256,
-	"sha384": CDXSHA384,
-	"sha512": CDXSHA512,
-}
-
-// ParseSRI decodes a Subresource Integrity string ("sha384-<base64>") into a
-// CycloneDX hash algorithm name ("SHA-384") and hex-encoded digest.
-func ParseSRI(sri string) (alg, hexDigest string, err error) {
-	prefix, b64, ok := strings.Cut(sri, "-")
-	if !ok {
-		return "", "", fmt.Errorf("integrity %q: missing algorithm prefix", sri)
-	}
-	cdxAlg, ok := sriAlgToCDX[strings.ToLower(prefix)]
-	if !ok {
-		return "", "", fmt.Errorf("integrity %q: unsupported algorithm %q", sri, prefix)
-	}
-	raw, err := base64.StdEncoding.DecodeString(b64)
-	if err != nil {
-		return "", "", fmt.Errorf("integrity %q: %w", sri, err)
-	}
-	return cdxAlg, hex.EncodeToString(raw), nil
-}
-
-// FormatSRI encodes a CycloneDX algorithm name and hex digest as an SRI string.
-func FormatSRI(cdxAlg, hexDigest string) (string, error) {
-	var prefix string
-	for k, v := range sriAlgToCDX {
-		if v == cdxAlg {
-			prefix = k
-			break
-		}
-	}
-	if prefix == "" {
-		return "", fmt.Errorf("unsupported CycloneDX algorithm %q", cdxAlg)
-	}
-	raw, err := hex.DecodeString(hexDigest)
-	if err != nil {
-		return "", err
-	}
-	return prefix + "-" + base64.StdEncoding.EncodeToString(raw), nil
-}
diff --git a/integrity/sri_test.go b/integrity/sri_test.go
deleted file mode 100644
index 673fb17..0000000
--- a/integrity/sri_test.go
+++ /dev/null
@@ -1,52 +0,0 @@
-package integrity
-
-import "testing"
-
-func TestParseSRI(t *testing.T) {
-	cases := []struct {
-		in      string
-		wantAlg string
-		wantHex string
-		wantErr bool
-	}{
-		{"sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC", "SHA-384", "a2a56e01f5d129aa7b7dd81c098e6eca433af91f46a90f0afeec72f6bc7b1cd42519897590fcd0868d70c7827063cc02", false},
-		{"sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=", "SHA-256", "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", false},
-		{"sha512-z4PhNX7vuL3xVChQ1m2AB9Yg5AULVxXcg/SpIdNs6c5H0NE8XYXysP+DGNKHfuwvY7kxvUdBeoGlODJ6+SfaPg==", "SHA-512", "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e", false},
-		{"", "", "", true},
-		{"sha384-not!base64", "", "", true},
-		{"md5-abc", "", "", true},
-		{"sha384", "", "", true},
-	}
-	for _, tc := range cases {
-		t.Run(tc.in, func(t *testing.T) {
-			alg, hex, err := ParseSRI(tc.in)
-			if (err != nil) != tc.wantErr {
-				t.Fatalf("err = %v, wantErr = %v", err, tc.wantErr)
-			}
-			if tc.wantErr {
-				return
-			}
-			if alg != tc.wantAlg {
-				t.Errorf("alg = %q, want %q", alg, tc.wantAlg)
-			}
-			if hex != tc.wantHex {
-				t.Errorf("hex = %q, want %q", hex, tc.wantHex)
-			}
-		})
-	}
-}
-
-func TestSRIRoundTrip(t *testing.T) {
-	in := "sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
-	alg, hex, err := ParseSRI(in)
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := FormatSRI(alg, hex)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if out != in {
-		t.Errorf("round-trip: %q != %q", out, in)
-	}
-}
diff --git a/lock/cyclonedx.go b/lock/cyclonedx.go
index 3d4bee2..7285a34 100644
--- a/lock/cyclonedx.go
+++ b/lock/cyclonedx.go
@@ -2,10 +2,11 @@ package lock
 
 import (
 	"cmp"
+	"fmt"
 	"slices"
 	"strconv"
 
-	"github.com/git-pkgs/pin/integrity"
+	"github.com/git-pkgs/integrity"
 )
 
 const (
@@ -152,8 +153,8 @@ func packageComponent(purl string, assets []Asset) cdxComponent {
 		Version: first.Version,
 		PURL:    purl,
 	}
-	if h := encodePackageHash(first.PackageIntegrity); h != nil {
-		c.Hashes = []cdxHash{*h}
+	if hashes := encodePackageHashes(first.PackageIntegrity); len(hashes) > 0 {
+		c.Hashes = hashes
 	}
 	if first.License != "" {
 		c.Licenses = []cdxLicense{{License: cdxLicenseID{ID: first.License}}}
@@ -224,8 +225,8 @@ func fileComponent(parentPURL string, a Asset) cdxComponent {
 		Name:   a.Path,
 	}
 	if a.Integrity != "" {
-		if alg, hex, err := integrity.ParseSRI(a.Integrity); err == nil {
-			c.Hashes = []cdxHash{{Alg: alg, Content: hex}}
+		if hashes := encodeSRIHashes(a.Integrity); len(hashes) > 0 {
+			c.Hashes = hashes
 		}
 	}
 	if a.URL != "" {
@@ -252,9 +253,9 @@ func fromCDX(bom *cdxBOM) (*Lock, error) {
 		OutDir:          findProp(bom.Metadata.Properties, propOutDir),
 	}
 	for _, pkg := range bom.Components {
-		var pkgIntegrity string
-		if len(pkg.Hashes) > 0 {
-			pkgIntegrity = decodePackageHash(pkg.Hashes[0])
+		pkgIntegrity, err := decodePackageHashes(pkg.Hashes)
+		if err != nil {
+			return nil, fmt.Errorf("package %q integrity: %w", pkg.Name, err)
 		}
 		var license string
 		if len(pkg.Licenses) > 0 {
@@ -277,11 +278,11 @@ func fromCDX(bom *cdxBOM) (*Lock, error) {
 				Format:           findProp(file.Properties, propFormat),
 				URL:              findExtRef(file.ExternalReferences, "distribution"),
 			}
-			if len(file.Hashes) > 0 {
-				if sri, err := integrity.FormatSRI(file.Hashes[0].Alg, file.Hashes[0].Content); err == nil {
-					a.Integrity = sri
-				}
+			fileIntegrity, err := decodeSRIHashes(file.Hashes)
+			if err != nil {
+				return nil, fmt.Errorf("file %q integrity: %w", file.Name, err)
 			}
+			a.Integrity = fileIntegrity
 			if s := findProp(file.Properties, propSize); s != "" {
 				a.Size, _ = strconv.ParseInt(s, 10, 64)
 			}
@@ -291,32 +292,102 @@ func fromCDX(bom *cdxBOM) (*Lock, error) {
 	return l, nil
 }
 
-// encodePackageHash converts an Asset.PackageIntegrity (either an SRI string
-// from npm or a bare commit SHA from a forge source) into a CycloneDX hash
-// entry. Forge SHAs are emitted as SHA-1; npm SRI is decoded to hex.
-func encodePackageHash(pkgIntegrity string) *cdxHash {
+func encodeSRIHashes(value string) []cdxHash {
+	digests, err := integrity.ParseSRI(value)
+	if err != nil {
+		return nil
+	}
+	hashes := make([]cdxHash, 0, len(digests))
+	for _, digest := range digests {
+		hashes = append(hashes, cdxHash{
+			Alg:     cdxAlgorithm(digest.Algorithm()),
+			Content: digest.Hex(),
+		})
+	}
+	return hashes
+}
+
+func decodeSRIHashes(hashes []cdxHash) (string, error) {
+	digests := make(integrity.SRI, 0, len(hashes))
+	for _, hash := range hashes {
+		algorithm, ok := sriAlgorithm(hash.Alg)
+		if !ok {
+			continue
+		}
+		digest, err := integrity.ParseHex(algorithm, hash.Content)
+		if err != nil {
+			return "", fmt.Errorf("invalid %s digest: %w", hash.Alg, err)
+		}
+		digests = append(digests, digest)
+	}
+	return integrity.FormatSRI(digests), nil
+}
+
+func cdxAlgorithm(algorithm integrity.Algorithm) string {
+	switch algorithm {
+	case integrity.SHA256:
+		return "SHA-256"
+	case integrity.SHA384:
+		return "SHA-384"
+	case integrity.SHA512:
+		return "SHA-512"
+	default:
+		return ""
+	}
+}
+
+func sriAlgorithm(algorithm string) (integrity.Algorithm, bool) {
+	switch algorithm {
+	case "SHA-256":
+		return integrity.SHA256, true
+	case "SHA-384":
+		return integrity.SHA384, true
+	case "SHA-512":
+		return integrity.SHA512, true
+	default:
+		return 0, false
+	}
+}
+
+// encodePackageHashes converts Asset.PackageIntegrity, either an SRI metadata
+// list from npm or a bare commit SHA from a forge source, into CycloneDX hash
+// entries. Forge SHAs remain SHA-1 values local to pin.
+func encodePackageHashes(pkgIntegrity string) []cdxHash {
 	if pkgIntegrity == "" {
 		return nil
 	}
-	if alg, hex, err := integrity.ParseSRI(pkgIntegrity); err == nil {
-		return &cdxHash{Alg: alg, Content: hex}
+	if hashes := encodeSRIHashes(pkgIntegrity); len(hashes) > 0 {
+		return hashes
 	}
 	if isCommitSHA(pkgIntegrity) {
-		return &cdxHash{Alg: "SHA-1", Content: pkgIntegrity}
+		return []cdxHash{{Alg: "SHA-1", Content: pkgIntegrity}}
 	}
 	return nil
 }
 
-// decodePackageHash is the inverse of encodePackageHash. SHA-1 entries pass
-// through as bare hex (forge commit SHAs); everything else round-trips via SRI.
-func decodePackageHash(h cdxHash) string {
-	if h.Alg == "SHA-1" && isCommitSHA(h.Content) {
-		return h.Content
+// decodePackageHashes is the inverse of encodePackageHashes. SHA-1 entries
+// remain bare commit values, while supported SRI digests stay in list order.
+func decodePackageHashes(hashes []cdxHash) (string, error) {
+	var commitSHA string
+	var sriHashes []cdxHash
+	for _, hash := range hashes {
+		if hash.Alg == "SHA-1" {
+			if !isCommitSHA(hash.Content) {
+				return "", fmt.Errorf("invalid SHA-1 commit digest %q", hash.Content)
+			}
+			if commitSHA == "" {
+				commitSHA = hash.Content
+			}
+			continue
+		}
+		if _, ok := sriAlgorithm(hash.Alg); ok {
+			sriHashes = append(sriHashes, hash)
+		}
 	}
-	if sri, err := integrity.FormatSRI(h.Alg, h.Content); err == nil {
-		return sri
+	if len(sriHashes) > 0 {
+		return decodeSRIHashes(sriHashes)
 	}
-	return ""
+	return commitSHA, nil
 }
 
 func isCommitSHA(s string) bool {
diff --git a/lock/cyclonedx_test.go b/lock/cyclonedx_test.go
index 165b915..1a098bc 100644
--- a/lock/cyclonedx_test.go
+++ b/lock/cyclonedx_test.go
@@ -1,6 +1,7 @@
 package lock
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/git-pkgs/sbom"
@@ -30,3 +31,89 @@ func TestOutputIsValidCycloneDX(t *testing.T) {
 		}
 	}
 }
+
+func TestCycloneDXMultiHashRoundTrip(t *testing.T) {
+	const sri256 = "sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU="
+	fileIntegrity := strings.Join([]string{sri256, sri384a, sri384b}, " ")
+	packageIntegrity := strings.Join([]string{sri256, sri512}, " ")
+	want := &Lock{Assets: []Asset{{
+		Name:             "multi-hash",
+		Version:          "1.0.0",
+		PURL:             "pkg:npm/multi-hash@1.0.0",
+		Path:             "dist/index.js",
+		Out:              "multi-hash/index.js",
+		Integrity:        fileIntegrity,
+		PackageIntegrity: packageIntegrity,
+	}}}
+
+	encoded := write(t, want)
+	got, err := Read(strings.NewReader(encoded))
+	if err != nil {
+		t.Fatalf("Read: %v", err)
+	}
+	if len(got.Assets) != 1 {
+		t.Fatalf("Assets = %d, want 1", len(got.Assets))
+	}
+	if got.Assets[0].Integrity != fileIntegrity {
+		t.Errorf("Integrity = %q, want %q", got.Assets[0].Integrity, fileIntegrity)
+	}
+	if got.Assets[0].PackageIntegrity != packageIntegrity {
+		t.Errorf("PackageIntegrity = %q, want %q", got.Assets[0].PackageIntegrity, packageIntegrity)
+	}
+}
+
+func TestCycloneDXRejectsMalformedSupportedHashes(t *testing.T) {
+	tests := []struct {
+		name string
+		bom  cdxBOM
+	}{
+		{
+			name: "package hash",
+			bom: cdxBOM{Components: []cdxComponent{{
+				Name:   "bad-package",
+				Hashes: []cdxHash{{Alg: "SHA-512", Content: "abcd"}},
+			}}},
+		},
+		{
+			name: "file hash",
+			bom: cdxBOM{Components: []cdxComponent{{
+				Name: "bad-file",
+				Components: []cdxComponent{{
+					Name:   "index.js",
+					Hashes: []cdxHash{{Alg: "SHA-384", Content: "not-hex"}},
+				}},
+			}}},
+		},
+		{
+			name: "forge commit hash",
+			bom: cdxBOM{Components: []cdxComponent{{
+				Name:   "bad-commit",
+				Hashes: []cdxHash{{Alg: "SHA-1", Content: "abc123"}},
+			}}},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if _, err := fromCDX(&test.bom); err == nil {
+				t.Fatal("fromCDX returned nil error")
+			}
+		})
+	}
+}
+
+func TestCycloneDXIgnoresUnsupportedHashes(t *testing.T) {
+	bom := cdxBOM{Components: []cdxComponent{{
+		Name: "other-hash",
+		Components: []cdxComponent{{
+			Name:   "index.js",
+			Hashes: []cdxHash{{Alg: "BLAKE3", Content: "abcd"}},
+		}},
+	}}}
+	lock, err := fromCDX(&bom)
+	if err != nil {
+		t.Fatalf("fromCDX: %v", err)
+	}
+	if len(lock.Assets) != 1 || lock.Assets[0].Integrity != "" {
+		t.Errorf("Assets = %+v", lock.Assets)
+	}
+}
diff --git a/verify.go b/verify.go
index 4ab68cc..043fce2 100644
--- a/verify.go
+++ b/verify.go
@@ -1,9 +1,8 @@
 package pin
 
 import (
+	"bytes"
 	"context"
-	"crypto/sha512"
-	"encoding/base64"
 	"errors"
 	"fmt"
 	"io"
@@ -13,6 +12,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/git-pkgs/integrity"
 	"github.com/git-pkgs/pin/lock"
 	"github.com/git-pkgs/pin/source/npm"
 	"github.com/git-pkgs/purl"
@@ -74,7 +74,7 @@ func (c *Client) Verify(opts VerifyOptions) (*VerifyResult, error) {
 	for _, a := range l.Assets {
 		known[a.Out] = true
 		p := filepath.Join(opts.Dir, l.OutDir, filepath.FromSlash(a.Out))
-		got, err := hashFile(p)
+		got, matches, err := verifyFile(p, a.Integrity)
 		if errors.Is(err, fs.ErrNotExist) {
 			res.Missing = append(res.Missing, a.Out)
 			continue
@@ -82,7 +82,7 @@ func (c *Client) Verify(opts VerifyOptions) (*VerifyResult, error) {
 		if err != nil {
 			return nil, fmt.Errorf("hash %s: %w", a.Out, err)
 		}
-		if got != a.Integrity {
+		if !matches {
 			res.Drifted = append(res.Drifted, Drift{Out: a.Out, Expected: a.Integrity, Actual: got})
 			continue
 		}
@@ -110,9 +110,9 @@ func (c *Client) Verify(opts VerifyOptions) (*VerifyResult, error) {
 }
 
 // verifyStrictNPM re-fetches each npm tarball, re-extracts the
-// lockfile's claimed files, and compares the derived per-file
-// SHA-384 to the recorded integrity. forge and url sources are
-// skipped because their per-file SHA-384 already IS the anchor.
+// lockfile's claimed files, and verifies their bytes against the
+// recorded integrity. forge and url sources are skipped because
+// their per-file hashes already are the anchor.
 func (c *Client) verifyStrictNPM(l *lock.Lock) ([]Drift, error) {
 	src := c.NPM
 
@@ -145,17 +145,21 @@ func (c *Client) verifyStrictNPM(l *lock.Lock) ([]Drift, error) {
 		if err != nil {
 			return nil, fmt.Errorf("re-derive %s: %w", key, err)
 		}
-		derived := map[string]string{}
+		derived := map[string][]byte{}
 		for _, f := range resolved.Files {
-			derived[f.Path] = f.Integrity
+			derived[f.Path] = f.Content
 		}
 		for _, a := range assets {
-			got, ok := derived[a.Path]
+			content, ok := derived[a.Path]
 			if !ok {
 				drifts = append(drifts, Drift{Out: a.Out, Expected: a.Integrity, Actual: "<not in tarball>"})
 				continue
 			}
-			if got != a.Integrity {
+			got, matches, err := verifyIntegrity(bytes.NewReader(content), a.Integrity)
+			if err != nil {
+				return nil, fmt.Errorf("verify %s integrity: %w", a.Path, err)
+			}
+			if !matches {
 				drifts = append(drifts, Drift{Out: a.Out, Expected: a.Integrity, Actual: got})
 			}
 		}
@@ -163,17 +167,41 @@ func (c *Client) verifyStrictNPM(l *lock.Lock) ([]Drift, error) {
 	return drifts, nil
 }
 
-func hashFile(path string) (string, error) {
+func verifyFile(path, expected string) (string, bool, error) {
 	f, err := os.Open(path)
 	if err != nil {
-		return "", err
+		return "", false, err
 	}
 	defer func() { _ = f.Close() }()
-	h := sha512.New384()
-	if _, err := io.Copy(h, f); err != nil {
-		return "", err
+	return verifyIntegrity(f, expected)
+}
+
+func verifyIntegrity(source io.Reader, expectedValue string) (string, bool, error) {
+	var expected integrity.SRI
+	algorithms := []integrity.Algorithm{integrity.SHA384}
+	if expectedValue != "" {
+		var err error
+		expected, err = integrity.ParseSRI(expectedValue)
+		if err != nil {
+			return "", false, fmt.Errorf("parse expected integrity: %w", err)
+		}
+		algorithms = algorithms[:0]
+		for _, digest := range expected {
+			algorithms = append(algorithms, digest.Algorithm())
+		}
+	}
+
+	reader, err := integrity.NewReader(source, algorithms...)
+	if err != nil {
+		return "", false, err
+	}
+	if _, err := io.Copy(io.Discard, reader); err != nil {
+		return "", false, err
 	}
-	return "sha384-" + base64.StdEncoding.EncodeToString(h.Sum(nil)), nil
+	result := reader.Result()
+	actual := integrity.FormatSRI(result.Digests)
+	matches := len(expected) > 0 && result.Verify(expected) == nil
+	return actual, matches, nil
 }
 
 func findExtras(root string, known map[string]bool) ([]string, error) {
diff --git a/verify_test.go b/verify_test.go
index 2b2857d..14fc7a4 100644
--- a/verify_test.go
+++ b/verify_test.go
@@ -2,6 +2,9 @@ package pin
 
 import (
 	"context"
+	"crypto/sha256"
+	"crypto/sha512"
+	"encoding/base64"
 	"os"
 	"path/filepath"
 	"testing"
@@ -43,6 +46,18 @@ func TestVerifyClean(t *testing.T) {
 	}
 }
 
+func TestVerifyMultiHash(t *testing.T) {
+	dir, _ := setupSynced(t)
+	addMultiHashIntegrity(t, dir)
+	res, err := Verify(VerifyOptions{Dir: dir})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if res.Failed() {
+		t.Errorf("clean multi-hash verify failed: %+v", res)
+	}
+}
+
 func TestVerifyMissing(t *testing.T) {
 	dir, _ := setupSynced(t)
 	if err := os.Remove(filepath.Join(dir, "v/demo/a.js")); err != nil {
@@ -109,7 +124,7 @@ func TestVerifyNoLockfile(t *testing.T) {
 
 // TestVerifyStrict exercises the --strict re-derive path: the inner
 // verifyStrictNPM that re-fetches each npm package's tarball and
-// recomputes per-file SHA-384 against the lockfile-recorded integrity.
+// verifies each file against the lockfile-recorded integrity.
 func TestVerifyStrict(t *testing.T) {
 	dir, srvURL := setupSynced(t)
 	res, err := Verify(VerifyOptions{Dir: dir, Strict: true, RegistryURL: srvURL})
@@ -121,6 +136,26 @@ func TestVerifyStrict(t *testing.T) {
 	}
 }
 
+func TestVerifyStrictMultiHash(t *testing.T) {
+	dir, srvURL := setupSynced(t)
+	addMultiHashIntegrity(t, dir)
+	res, err := Verify(VerifyOptions{Dir: dir, Strict: true, RegistryURL: srvURL})
+	if err != nil {
+		t.Fatalf("Verify --strict: %v", err)
+	}
+	if res.Failed() {
+		t.Errorf("clean multi-hash --strict verify failed: %+v", res)
+	}
+}
+
+func TestSyncNoFetchMultiHash(t *testing.T) {
+	dir, _ := setupSynced(t)
+	addMultiHashIntegrity(t, dir)
+	if _, err := Sync(context.Background(), SyncOptions{Dir: dir, NoFetch: true}); err != nil {
+		t.Errorf("--no-fetch on clean multi-hash tree: %v", err)
+	}
+}
+
 // TestVerifyStrict_TarballMismatch covers the case where the
 // registry-side bytes drift from what the lockfile recorded. We swap
 // in a fakeNPM that returns a different tarball than the one we
@@ -156,3 +191,28 @@ func TestVerifySummary(t *testing.T) {
 		t.Errorf("Summary() = %q, want %q", got, want)
 	}
 }
+
+func addMultiHashIntegrity(t *testing.T, dir string) {
+	t.Helper()
+	l, err := readLock(filepath.Join(dir, DefaultLock))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for i, asset := range l.Assets {
+		content, err := os.ReadFile(filepath.Join(dir, l.OutDir, asset.Out))
+		if err != nil {
+			t.Fatal(err)
+		}
+		digest256 := sha256.Sum256(content)
+		digest512 := sha512.Sum512(content)
+		l.Assets[i].Integrity = "sha256-" + base64.StdEncoding.EncodeToString(digest256[:]) + " " +
+			asset.Integrity + " sha512-" + base64.StdEncoding.EncodeToString(digest512[:])
+	}
+	encoded, err := EncodeLock(l)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, DefaultLock), encoded, 0o644); err != nil {
+		t.Fatal(err)
+	}
+}