diff --git a/vulncheck/source.go b/vulncheck/source.go
index 55f3777..9ceb993 100644
--- a/vulncheck/source.go
+++ b/vulncheck/source.go
@@ -9,6 +9,7 @@
 	"fmt"
 	"go/token"
 	"runtime"
+	"sort"
 
 	"golang.org/x/tools/go/callgraph"
 	"golang.org/x/tools/go/ssa"
@@ -178,7 +179,14 @@
 	// We first collect inverse requires by (predecessor)
 	// relation on module node ids.
 	modPredRelation := make(map[int]map[int]bool)
-	for _, pkgNode := range result.Imports.Packages {
+	// Sort keys so modules are assigned IDs deterministically, for tests.
+	var pkgIDs []int
+	for id := range result.Imports.Packages {
+		pkgIDs = append(pkgIDs, id)
+	}
+	sort.Ints(pkgIDs)
+	for _, id := range pkgIDs {
+		pkgNode := result.Imports.Packages[id]
 		// Create or get module node for pkgNode.
 		pkgModID := moduleNodeID(pkgNode, result, modNodeIDs)
 		pkgNode.Module = pkgModID