diff --git a/CHANGELOG.md b/CHANGELOG.md
index dc2923f5..c6c209e3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -30,6 +30,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/):
 
 - Deprecate `backward --far` and `forward --far` in favor of `backward wide` and `forward wide`, respectively ([#4012])
 
+### Fixed
+
+- Keep package hashes indifferent to line endings when `ya pkg` pulls packages
+
 ### Improved
 
 - Eliminate hacks in image and UI conflict resolution ([#4022])
diff --git a/scripts/validate-form/package-lock.json b/scripts/validate-form/package-lock.json
index 6e873bca..87395153 100644
--- a/scripts/validate-form/package-lock.json
+++ b/scripts/validate-form/package-lock.json
@@ -238,9 +238,9 @@
 			}
 		},
 		"node_modules/undici": {
-			"version": "6.25.0",
-			"resolved": "https://registry.npmjs.org/undici/-/undici-6.25.0.tgz",
-			"integrity": "sha512-ZgpWDC5gmNiuY9CnLVXEH8rl50xhRCuLNA97fAUnKi8RRuV4E6KG31pDTsLVUKnohJE0I3XDrTeEydAXRw47xg==",
+			"version": "6.27.0",
+			"resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz",
+			"integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==",
 			"license": "MIT",
 			"engines": {
 				"node": ">=18.17"
diff --git a/yazi-cli/src/package/git.rs b/yazi-cli/src/package/git.rs
index 3d1e85df..506b54d5 100644
--- a/yazi-cli/src/package/git.rs
+++ b/yazi-cli/src/package/git.rs
@@ -45,11 +45,15 @@ impl Git {
 	async fn exec(f: impl FnOnce(&mut Command) -> &mut Command) -> Result<()> {
 		let status = f(Command::new("git").args([
 			"-c",
-			"advice.detachedHead=false",
+			"core.eol=lf",
+			"-c",
+			"core.autocrlf=false",
+			"-c",
+			"clone.defaultRemoteName=origin",
 			"-c",
 			"checkout.defaultRemote=origin",
 			"-c",
-			"clone.defaultRemoteName=origin",
+			"advice.detachedHead=false",
 		]))
 		.status()
 		.await