diff --git a/vendor/cmd/go/internal/modfetch/fetch.go b/vendor/cmd/go/internal/modfetch/fetch.go
index 595ea3a..657f0d5 100644
--- a/vendor/cmd/go/internal/modfetch/fetch.go
+++ b/vendor/cmd/go/internal/modfetch/fetch.go
@@ -171,6 +171,10 @@
 	// Do the file I/O before acquiring the go.sum lock.
 	data, err := ioutil.ReadFile(filepath.Join(SrcMod, "cache/download", mod.Path, "@v", mod.Version+".ziphash"))
 	if err != nil {
+		if os.IsNotExist(err) {
+			// This can happen if someone does rm -rf GOPATH/src/cache/download. So it goes.
+			return
+		}
 		base.Fatalf("vgo: verifying %s@%s: %v", mod.Path, mod.Version, err)
 	}
 	h := strings.TrimSpace(string(data))
diff --git a/vendor/cmd/go/vgo_test.go b/vendor/cmd/go/vgo_test.go
index fb0ad51..e4b7065 100644
--- a/vendor/cmd/go/vgo_test.go
+++ b/vendor/cmd/go/vgo_test.go
@@ -735,6 +735,11 @@
 	if !strings.Contains(string(data), " v0.8.0 ") {
 		t.Fatalf("cannot find module tree hash in go.sum: %v\n%s", err, data)
 	}
+
+	tg.must(os.Remove(filepath.Join(gopath, "src/mod/cache/download/github.com/pkg/errors/@v/v0.8.0.ziphash")))
+	tg.run("-vgo", "mod", "-sync") // ignores missing ziphash file for ordinary go.sum validation
+
+	tg.runFail("-vgo", "mod", "-verify") // explicit verify fails with missing ziphash
 }
 
 func TestVendorWithoutDeps(t *testing.T) {