diff --git a/modules/npm/package_builder.go b/modules/npm/package_builder.go
index b98d3dcc1..3294936bb 100644
--- a/modules/npm/package_builder.go
+++ b/modules/npm/package_builder.go
@@ -207,6 +207,19 @@ func Pack(sourceFs, assetsWithDuplicatesPreservedFs afero.Fs, mods modules.Modul
 		devDependenciesKey: moduleDevDeps,
 	}
 
+	if err := sourceFs.MkdirAll(files.FolderPackagesHugoAutoGen, 0o777); err != nil {
+		return err
+	}
+	if err := writeJSON(sourceFs, workspacePackageJSON, autoGenPkg); err != nil {
+		return err
+	}
+
+	// 5. Ensure root package.json references the workspace.
+	if err := ensureWorkspaceRef(sourceFs, workspacePath); err != nil {
+		return err
+	}
+
+	// 6. Write metadata for the final on-disk package state.
 	metaFile := packageMeta{
 		Sum: PackageFilesSum(sourceFs, mods),
 		DependencySources: dependencySources{
@@ -214,19 +227,7 @@ func Pack(sourceFs, assetsWithDuplicatesPreservedFs afero.Fs, mods modules.Modul
 			DevDependencies: moduleDevDepsComments,
 		},
 	}
-
-	if err := sourceFs.MkdirAll(files.FolderPackagesHugoAutoGen, 0o777); err != nil {
-		return err
-	}
-	if err := writeJSON(sourceFs, workspacePackageJSON, autoGenPkg); err != nil {
-		return err
-	}
-	if err := writeJSON(sourceFs, workspacePackageMetaJSON, metaFile); err != nil {
-		return err
-	}
-
-	// 5. Ensure root package.json references the workspace.
-	return ensureWorkspaceRef(sourceFs, workspacePath)
+	return writeJSON(sourceFs, workspacePackageMetaJSON, metaFile)
 }
 
 // ensureWorkspaceRef adds workspacePath to the "workspaces" array in root
diff --git a/modules/npm/package_builder_integration_test.go b/modules/npm/package_builder_integration_test.go
index 028bb6549..65649d7ce 100644
--- a/modules/npm/package_builder_integration_test.go
+++ b/modules/npm/package_builder_integration_test.go
@@ -21,6 +21,7 @@ import (
 	"github.com/gohugoio/hugo/hugolib"
 	"github.com/gohugoio/hugo/modules"
 	"github.com/gohugoio/hugo/modules/npm"
+	"github.com/spf13/afero"
 )
 
 func getPackageBuilderTestFiles() string {
@@ -49,7 +50,7 @@ PACKAGE_CONTENT
 "version": "0.1.1",
 "dependencies": {
 	"react-dom": "1.1.1",
-	"tailwindcss": "1.2.0",	
+	"tailwindcss": "1.2.0",
 	"@babel/cli": "7.8.4",
 	"@babel/core": "7.9.0",
 	"@babel/preset-env": "7.9.5"
@@ -70,9 +71,25 @@ func TestPackageBuilder(t *testing.T) {
 	files := getPackageBuilderTestFiles()
 	b := hugolib.Test(t, files)
 	fs := b.H.Fs.WorkingDirReadOnly
+	sourceFs := b.H.BaseFs.ProjectSourceFs
+	assetsFs := b.H.BaseFs.AssetsWithDuplicatesPreserved.Fs
+	mods := b.H.Configs.Modules
 
 	sum := npm.PackageFilesSum(fs, b.H.AllModules())
-	b.Assert(sum, qt.Equals, "ce880d142ad9a16a")
+	b.Assert(sum, qt.Equals, "528bb6507993888c")
+
+	b.Assert(npm.Pack(sourceFs, assetsFs, mods), qt.IsNil)
+	b.Assert(npm.NpmPackNeedsUpdate(sourceFs, mods), qt.IsFalse)
+
+	meta1, err := afero.ReadFile(sourceFs, "packages/hugoautogen/hugo_packagemeta.json")
+	b.Assert(err, qt.IsNil)
+
+	b.Assert(npm.Pack(sourceFs, assetsFs, mods), qt.IsNil)
+	b.Assert(npm.NpmPackNeedsUpdate(sourceFs, mods), qt.IsFalse)
+
+	meta2, err := afero.ReadFile(sourceFs, "packages/hugoautogen/hugo_packagemeta.json")
+	b.Assert(err, qt.IsNil)
+	b.Assert(string(meta2), qt.Equals, string(meta1))
 }
 
 func BenchmarkPackageFilesSum(b *testing.B) {
@@ -83,6 +100,6 @@ func BenchmarkPackageFilesSum(b *testing.B) {
 
 	for b.Loop() {
 		sum := npm.PackageFilesSum(fs, modules.Modules{})
-		bb.Assert(sum, qt.Equals, "ce880d142ad9a16a")
+		bb.Assert(sum, qt.Equals, "528bb6507993888c")
 	}
 }
diff --git a/testscripts/commands/mod_npm__moduleorder.txt b/testscripts/commands/mod_npm__moduleorder.txt
index 1d4580c4d..4dc202046 100644
--- a/testscripts/commands/mod_npm__moduleorder.txt
+++ b/testscripts/commands/mod_npm__moduleorder.txt
@@ -5,6 +5,9 @@ cmp packages/hugoautogen/package.json golden1/packages/hugoautogen/package.json
 cmp package.json golden1/package.json
 cmp packages/hugoautogen/hugo_packagemeta.json golden1/packages/hugoautogen/hugo_packagemeta.json
 
+hugo mod graph
+! stderr 'WARN  npm dependencies are out of sync'
+
 -- hugo.toml --
 baseURL = "https://example.org/"
 [module]
@@ -44,7 +47,7 @@ go 1.20
 }
 -- golden1/packages/hugoautogen/hugo_packagemeta.json --
 {
-  "sum": "dd3590c300b0bebb",
+  "sum": "98594123fa88aedf",
   "dependencySources": {
     "dependencies": {
       "count-days-in-month": "github.com/gohugoio/hugoTestModsNPMNested/a",