diff --git a/lib/inject.js b/lib/inject.js
index dc30be79..e17800c4 100644
--- a/lib/inject.js
+++ b/lib/inject.js
@@ -39,9 +39,10 @@ function injectRequirements(requirementsPath, packagePath, options) {
         .map(([file, relativeFile]) =>
           Promise.all([file, relativeFile, fse.statAsync(file)])
         )
-        .map(([file, relativeFile, fileStat]) =>
+        .mapSeries(([file, relativeFile, fileStat]) =>
           zipFile(zip, relativeFile, fse.readFileAsync(file), {
-            unixPermissions: fileStat.mode
+            unixPermissions: fileStat.mode,
+            createFolders: false
           })
         )
         .then(() => writeZip(zip, packagePath))
diff --git a/test.js b/test.js
index d28daa6e..1325ca6a 100644
--- a/test.js
+++ b/test.js
@@ -2,6 +2,7 @@ const crossSpawn = require('cross-spawn');
 const deasync = require('deasync-promise');
 const glob = require('glob-all');
 const JSZip = require('jszip');
+const sha256File = require('sha256-file');
 const tape = require('tape');
 const {
   chmodSync,
@@ -133,6 +134,17 @@ test('default pythonBin can package flask with default options', t => {
   t.end();
 });
 
+test('py3.6 packages have the same hash', t => {
+  process.chdir('tests/base');
+  const path = npm(['pack', '../..']);
+  npm(['i', path]);
+  sls(['package']);
+  const fileHash = sha256File('.serverless/sls-py-req-test.zip');
+  sls(['package']);
+  t.equal(sha256File('.serverless/sls-py-req-test.zip'), fileHash, 'packages have the same hash');
+  t.end();
+});
+
 test('py3.6 can package flask with default options', t => {
   process.chdir('tests/base');
   const path = npm(['pack', '../..']);