diff --git a/etc/freight.conf.example b/etc/freight.conf.example
index d1b78d0..ca6cba7 100644
--- a/etc/freight.conf.example
+++ b/etc/freight.conf.example
@@ -12,8 +12,8 @@ LABEL="Freight"
 NOT_AUTOMATIC="no"
 BUT_AUTOMATIC_UPGRADES="no"
 
-# Cache the control files after each run (on), or regenerate them every
-# time (off).
+# Cache the control files and hashes after each run (on), or regenerate
+# them every time (off).
 CACHE="off"
 
 # GPG key(s) to use to sign repositories.  This is required by the `apt`
diff --git a/lib/freight/apt.sh b/lib/freight/apt.sh
index 21a09aa..7d9f14d 100644
--- a/lib/freight/apt.sh
+++ b/lib/freight/apt.sh
@@ -56,7 +56,7 @@ apt_source_origversion() {
 # Print the prefix for a package name.
 apt_prefix() {
     [ "$(echo "$1" | cut -c1-3)" = "lib" ] && C=4 || C=1
-    echo "$1" | cut -c-$C
+    echo "$1" | cut "-c-$C"
 }
 
 # Print the checksum portion of the normal checksumming programs' output.
@@ -79,19 +79,27 @@ apt_filesize() {
 }
 
 # Compute the hash of type $1 for source file $2. If the file has a
-# corresponding `.$filename-$method` file the hash in this file will be returned
+# corresponding `$3-$method` file the hash in this file will be returned
 # instead. The hash will also be recomputed if the source file is newer than the
-# hash file.
+# hash file. If $3 is empty this implies that cache is disabled and so no
+# cache file will be used.
 apt_hash() {
     method="$1"
     f="$2"
-    h="$(dirname "$f")/.$(basename "$f").${method}"
+    hashroot="$3"
 
-    if [ ! -f "$h" ] || test "$f" -nt "$h"; then
-        eval "apt_${method}" "$f" > "$h"
+    if [ "$hashroot" = "" ]; then
+        # Cache disabled
+        eval "apt_${method}" "$f"
+    else
+        # Cache enabled
+        h="$hashroot-$method"
+        if [ ! -f "$h" ] || test "$f" -nt "$h"; then
+            eval "apt_${method}" "$f" > "$h"
+        fi
+        cat "${h}"
     fi
 
-    cat "${h}"
 }
 
 # Setup the repository for the distro named in the first argument,
@@ -106,6 +114,9 @@ apt_cache() {
     DATE="$(date +%Y%m%d%H%M%S%N)"
     DISTCACHE="$VARCACHE/dists/$DIST-$DATE"
 
+    # Cached hashes will live in the freight var lib directory.
+    HASHDIR="$VARLIB/.apt/$DIST"
+
     # For a Debian archive, each distribution needs at least this directory
     # structure in place.  The directory for this build must not exist,
     # otherwise this build would clobber a previous one.  The `.refs`
@@ -199,11 +210,17 @@ EOF
         # In the future, `Sources` may find a place here, too.
         find "$DISTCACHE" -mindepth 2 -type f -not -name '.*' -printf %P\\n |
             while read -r FILE; do
+                if [ "$CACHE" = "on" ]; then
+                    HASHFILEROOT="$HASHDIR/$FILE"
+                    mkdir -p "$(dirname "$HASHFILEROOT")"
+                else
+                    HASHFILEROOT=""
+                fi
                 SIZE="$(apt_filesize "$DISTCACHE/$FILE")"
-                echo " $(apt_hash md5 "$DISTCACHE/$FILE") $SIZE $FILE" >&3
-                echo " $(apt_hash sha1 "$DISTCACHE/$FILE") $SIZE $FILE" >&4
-                echo " $(apt_hash sha256 "$DISTCACHE/$FILE") $SIZE $FILE" >&5
-                echo " $(apt_hash sha512 "$DISTCACHE/$FILE") $SIZE $FILE" >&6
+                echo " $(apt_hash md5 "$DISTCACHE/$FILE" "$HASHFILEROOT") $SIZE $FILE" >&3
+                echo " $(apt_hash sha1 "$DISTCACHE/$FILE" "$HASHFILEROOT") $SIZE $FILE" >&4
+                echo " $(apt_hash sha256 "$DISTCACHE/$FILE" "$HASHFILEROOT") $SIZE $FILE" >&5
+                echo " $(apt_hash sha512 "$DISTCACHE/$FILE" "$HASHFILEROOT") $SIZE $FILE" >&6
             done 3>"$TMP/md5sums" 4>"$TMP/sha1sums" 5>"$TMP/sha256sums" 6>"$TMP/sha512sums"
         echo "MD5Sum:"
         cat "$TMP/md5sums"
@@ -278,6 +295,8 @@ apt_clear_cache() {
     find "$VARLIB/apt/$DIST" -name '*-control' -print0 | xargs -0 --no-run-if-empty rm
     # Next remove the source control cache
     find "$VARLIB/apt/$DIST" -name '*-cached' -print0 | xargs -0 --no-run-if-empty rm
+    # Finally remove the cached hashes
+    rm -fr "$VARLIB/.apt/$DIST"
 }
 
 # Add a binary package to the given dist and to the pool.