diff --git a/pkgs/by-name/pr/prometheus/update.sh b/pkgs/by-name/pr/prometheus/update.sh
index 2f3b54b8aed4..489a092aac61 100755
--- a/pkgs/by-name/pr/prometheus/update.sh
+++ b/pkgs/by-name/pr/prometheus/update.sh
@@ -49,9 +49,22 @@ cat > "$SOURCE_NIX" <<-EOF
 }
 EOF
 
-VENDOR_HASH=$(extractHash prometheus.goModules)
+# Resolve pnpm hash first: the Go integration pulls in the assets, so a fake
+# pnpmDepsHash makes that stage fail.
 PNPM_DEPS_HASH=$(extractHash prometheus.assets.pnpmDeps)
 
+cat > "$SOURCE_NIX" <<-EOF
+{
+  version = "$TARGET_VERSION";
+  hash = "$PREFETCH_HASH";
+  pnpmDepsHash = "$PNPM_DEPS_HASH";
+  vendorHash = "$FAKE_HASH";
+}
+EOF
+
+# Now do the Go module fetch.
+VENDOR_HASH=$(extractHash prometheus.goModules)
+
 cat > "$SOURCE_NIX" <<-EOF
 {
   version = "$TARGET_VERSION";