diff --git a/lib/pip.js b/lib/pip.js
index df107e23..3da432af 100644
--- a/lib/pip.js
+++ b/lib/pip.js
@@ -9,7 +9,7 @@ const { buildImage, getBindPath, getDockerUid } = require('./docker');
 const { getStripCommand, getStripMode, deleteFiles } = require('./slim');
 const {
   checkForAndDeleteMaxCacheVersions,
-  md5Path,
+  sha256Path,
   getRequirementsWorkingPath,
   getUserCachePath
 } = require('./shared');
@@ -474,7 +474,7 @@ function installRequirementsIfNeeded(
   }
 
   // Then generate our MD5 Sum of this requirements file to determine where it should "go" to and/or pull cache from
-  const reqChecksum = md5Path(slsReqsTxt);
+  const reqChecksum = sha256Path(slsReqsTxt);
 
   // Then figure out where this cache should be, if we're caching, if we're in a module, etc
   const workingReqsFolder = getRequirementsWorkingPath(
diff --git a/lib/shared.js b/lib/shared.js
index fe48e0e0..34f61eb2 100644
--- a/lib/shared.js
+++ b/lib/shared.js
@@ -1,9 +1,9 @@
 const Appdir = require('appdirectory');
 const rimraf = require('rimraf');
-const md5File = require('md5-file');
 const glob = require('glob-all');
 const path = require('path');
 const fse = require('fs-extra');
+const sha256File = require('sha256-file');
 
 /**
  * This helper will check if we're using static cache and have max
@@ -100,13 +100,13 @@ function getUserCachePath(options) {
  * @param  {string} fullpath
  * @return {string}
  */
-function md5Path(fullpath) {
-  return md5File.sync(fullpath);
+function sha256Path(fullpath) {
+  return sha256File(fullpath);
 }
 
 module.exports = {
   checkForAndDeleteMaxCacheVersions,
   getRequirementsWorkingPath,
   getUserCachePath,
-  md5Path
+  sha256Path
 };
diff --git a/package.json b/package.json
index eb372906..1178d436 100644
--- a/package.json
+++ b/package.json
@@ -60,9 +60,9 @@
     "lodash.set": "^4.3.2",
     "lodash.uniqby": "^4.0.0",
     "lodash.values": "^4.3.0",
-    "md5-file": "^4.0.0",
     "rimraf": "^2.6.2",
-    "shell-quote": "^1.6.1"
+    "shell-quote": "^1.6.1",
+    "sha256-file": "1.0.0"
   },
   "eslintConfig": {
     "extends": "eslint:recommended",
diff --git a/test.js b/test.js
index 08dd3f68..2ec71976 100644
--- a/test.js
+++ b/test.js
@@ -14,7 +14,7 @@ const {
 const { quote } = require('shell-quote');
 const { sep } = require('path');
 
-const { getUserCachePath, md5Path } = require('./lib/shared');
+const { getUserCachePath, sha256Path } = require('./lib/shared');
 
 const initialWorkingDir = process.cwd();
 
@@ -1679,7 +1679,7 @@ test('py3.6 uses static and download cache', t => {
   npm(['i', path]);
   sls(['--useDownloadCache=true', '--useStaticCache=true', 'package']);
   const cachepath = getUserCachePath();
-  const cacheFolderHash = md5Path('.serverless/requirements.txt');
+  const cacheFolderHash = sha256Path('.serverless/requirements.txt');
   t.true(
     pathExistsSync(`${cachepath}${sep}downloadCacheslspyc${sep}http`),
     'http exists in download-cache'
@@ -1704,7 +1704,7 @@ test(
       'package'
     ]);
     const cachepath = getUserCachePath();
-    const cacheFolderHash = md5Path('.serverless/requirements.txt');
+    const cacheFolderHash = sha256Path('.serverless/requirements.txt');
     t.true(
       pathExistsSync(`${cachepath}${sep}downloadCacheslspyc${sep}http`),
       'http exists in download-cache'
@@ -1724,7 +1724,7 @@ test('py3.6 uses static cache', t => {
   npm(['i', path]);
   sls(['--useStaticCache=true', 'package']);
   const cachepath = getUserCachePath();
-  const cacheFolderHash = md5Path('.serverless/requirements.txt');
+  const cacheFolderHash = sha256Path('.serverless/requirements.txt');
   t.true(
     pathExistsSync(`${cachepath}${sep}${cacheFolderHash}_slspyc${sep}flask`),
     'flask exists in static-cache'
@@ -1758,7 +1758,7 @@ test('py3.6 uses static cache with cacheLocation option', t => {
   npm(['i', path]);
   const cachepath = '.requirements-cache';
   sls(['--useStaticCache=true', `--cacheLocation=${cachepath}`, 'package']);
-  const cacheFolderHash = md5Path('.serverless/requirements.txt');
+  const cacheFolderHash = sha256Path('.serverless/requirements.txt');
   t.true(
     pathExistsSync(`${cachepath}${sep}${cacheFolderHash}_slspyc${sep}flask`),
     'flask exists in static-cache'
@@ -1785,7 +1785,7 @@ test(
       'package'
     ]);
     const cachepath = getUserCachePath();
-    const cacheFolderHash = md5Path('.serverless/requirements.txt');
+    const cacheFolderHash = sha256Path('.serverless/requirements.txt');
     t.true(
       pathExistsSync(`${cachepath}${sep}${cacheFolderHash}_slspyc${sep}flask`),
       'flask exists in static-cache'