diff --git a/vulncheck/source.go b/vulncheck/source.go
index b5206e9..8b30bce 100644
--- a/vulncheck/source.go
+++ b/vulncheck/source.go
@@ -6,6 +6,8 @@
 
 import (
 	"context"
+	"fmt"
+	"go/token"
 	"runtime"
 
 	"golang.org/x/tools/go/callgraph"
@@ -21,6 +23,23 @@
 //  - call graph leading to the use of a known vulnerable function
 //    or method
 func Source(ctx context.Context, pkgs []*Package, cfg *Config) (*Result, error) {
+
+	// buildSSA builds a whole program that assumes all packages use the same FileSet.
+	// Check all packages in pkgs are using the same FileSet.
+	// TODO(hyangah): Alternative is to take FileSet out of Package and
+	// let Source take a single FileSet. That will make the enforcement
+	// clearer from the API level.
+	var fset *token.FileSet
+	for _, p := range pkgs {
+		if fset == nil {
+			fset = p.Fset
+		} else {
+			if fset != p.Fset {
+				return nil, fmt.Errorf("[]*Package must have created with the same FileSet")
+			}
+		}
+	}
+
 	modVulns, err := fetchVulnerabilities(ctx, cfg.Client, extractModules(pkgs))
 	if err != nil {
 		return nil, err
@@ -38,7 +57,7 @@
 		return result, nil
 	}
 
-	prog, ssaPkgs := buildSSA(pkgs)
+	prog, ssaPkgs := buildSSA(pkgs, fset)
 	entries := entryPoints(ssaPkgs)
 	cg := callGraph(prog, entries)
 	vulnCallGraphSlice(entries, modVulns, cg, result)
diff --git a/vulncheck/utils.go b/vulncheck/utils.go
index 08448da..780cd63 100644
--- a/vulncheck/utils.go
+++ b/vulncheck/utils.go
@@ -23,8 +23,8 @@
 // buildSSA creates an ssa representation for pkgs. Returns
 // the ssa program encapsulating the packages and top level
 // ssa packages corresponding to pkgs.
-func buildSSA(pkgs []*Package) (*ssa.Program, []*ssa.Package) {
-	prog := ssa.NewProgram(token.NewFileSet(), ssa.BuilderMode(0))
+func buildSSA(pkgs []*Package, fset *token.FileSet) (*ssa.Program, []*ssa.Package) {
+	prog := ssa.NewProgram(fset, ssa.BuilderMode(0))
 
 	imports := make(map[*Package]*ssa.Package)
 	var createImports func([]*Package)