diff --git a/metadata/is.xyz.mpv.yml b/metadata/is.xyz.mpv.yml
index f558ada018..2be7be78df 100644
--- a/metadata/is.xyz.mpv.yml
+++ b/metadata/is.xyz.mpv.yml
@@ -91,20 +91,25 @@ Builds:
       - cp -r $$fribidi$$ fribidi
       - cp -r $$harfbuzz$$ harfbuzz
       - cp -r $$libass$$ libass
-      - mkdir lua
-      - wget https://www.lua.org/ftp/lua-5.2.4.tar.gz -O - | tar -xz --strip-components=1
-        -C lua
       - cp -r $$mpv$$ mpv
+      - mkdir lua
+      - curl -Lo lua.tar.gz https://www.lua.org/ftp/lua-5.2.4.tar.gz
+      - echo "b9e2e4aad6789b3b63a056d442f7b39f0ecfca3ae0f1fc0ae4e9614401b69f4b lua.tar.gz"
+        | sha256sum -c -
+      - tar -xz --strip-components=1 -C lua -f lua.tar.gz
       - popd
       - sed -i -e '/gradlew/d' scripts/mpv-android.sh
       - sed -i -e '/"$target" == "mpv-android"/,/ls -lh/d' buildall.sh
     scandelete:
       - buildscripts/deps/mbedtls/
+      - buildscripts/deps/lua.tar.gz
     build:
       - cd ../buildscripts/
       - mkdir -p sdk
       - cd sdk
       - curl -Lo ndk.zip https://dl.google.com/android/repository/android-ndk-r23-linux.zip
+      - echo "e3eacf80016b91d4cd2c8ca9f34eebd32df912bb799c859cc5450b6b19277b4f ndk.zip"
+        | sha256sum -c -
       - unzip -q ndk.zip
       - cd ..
       - ./buildall.sh --arch arm64 mpv