diff --git a/lib/trivial.nix b/lib/trivial.nix
index 25ce35570fdf..3e606f0df48f 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -113,4 +113,7 @@ rec {
   */
   warn = msg: builtins.trace "WARNING: ${msg}";
   info = msg: builtins.trace "INFO: ${msg}";
+
+  fetchMD5warn = name: context : data : warn
+    "Deprecated use of MD5 hash in ${name} to fetch ${context}" data;
 }
diff --git a/pkgs/build-support/fetchdarcs/default.nix b/pkgs/build-support/fetchdarcs/default.nix
index 3c2e0524eea5..ecec51590b95 100644
--- a/pkgs/build-support/fetchdarcs/default.nix
+++ b/pkgs/build-support/fetchdarcs/default.nix
@@ -7,7 +7,8 @@ stdenv.mkDerivation {
 
   outputHashAlgo = if sha256 == "" then "md5" else "sha256";
   outputHashMode = "recursive";
-  outputHash = if sha256 == "" then md5 else sha256;
+  outputHash = if sha256 == "" then
+    (stdenv.lib.fetchMD5warn "fetchdarcs" url md5) else sha256;
   
   inherit url rev context;
 }
diff --git a/pkgs/build-support/fetchegg/default.nix b/pkgs/build-support/fetchegg/default.nix
index 3e0d5d566ad7..e82d4d95ac26 100644
--- a/pkgs/build-support/fetchegg/default.nix
+++ b/pkgs/build-support/fetchegg/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
 
   outputHashAlgo = if sha256 == "" then "md5" else "sha256";
   outputHashMode = "recursive";
-  outputHash = if sha256 == "" then md5 else sha256;
+  outputHash = if sha256 == "" then
+    (stdenv.lib.fetchMD5warn "fetchegg" name md5) else sha256;
 
   inherit version;
 
diff --git a/pkgs/build-support/fetchfile/default.nix b/pkgs/build-support/fetchfile/default.nix
index bdddfab2b4d6..685c1e69520a 100644
--- a/pkgs/build-support/fetchfile/default.nix
+++ b/pkgs/build-support/fetchfile/default.nix
@@ -1,7 +1,11 @@
-{stdenv}: {pathname, md5}: stdenv.mkDerivation {
+{stdenv}: {pathname, md5 ? "", sha256 ? ""}: stdenv.mkDerivation {
   name = baseNameOf (toString pathname);
   builder = ./builder.sh;
   pathname = pathname;
-  md5 = md5;
+} // if (sha256 == "") then {
+  md5 = (stdenv.lib.fetchMD5warn "fetchfile" pathname md5);
   id = md5;
+} else {
+  sha256 = sha256;
+  id = sha256;
 }
diff --git a/pkgs/build-support/fetchgit/default.nix b/pkgs/build-support/fetchgit/default.nix
index 105b3d56bf42..59e06c95ebba 100644
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@@ -50,7 +50,8 @@ stdenv.mkDerivation {
 
   outputHashAlgo = if sha256 == "" then "md5" else "sha256";
   outputHashMode = "recursive";
-  outputHash = if sha256 == "" then md5 else sha256;
+  outputHash = if sha256 == "" then
+    (stdenv.lib.fetchMD5warn "fetchgit" url md5) else sha256;
 
   inherit url rev leaveDotGit fetchSubmodules deepClone branchName;
 
diff --git a/pkgs/build-support/fetchhg/default.nix b/pkgs/build-support/fetchhg/default.nix
index 79f610166a79..b30a3556b0fe 100644
--- a/pkgs/build-support/fetchhg/default.nix
+++ b/pkgs/build-support/fetchhg/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation {
 
   outputHashAlgo = if md5 != null then "md5" else "sha256";
   outputHashMode = "recursive";
-  outputHash = if md5 != null then md5 else sha256;
+  outputHash = if md5 != null then
+    (stdenv.lib.fetchMD5warn "fetchhg" url md5) else sha256;
 
   inherit url rev;
   preferLocalBuild = true;
diff --git a/pkgs/build-support/fetchsvn/default.nix b/pkgs/build-support/fetchsvn/default.nix
index 85ec52c4bde0..b6f68e21384d 100644
--- a/pkgs/build-support/fetchsvn/default.nix
+++ b/pkgs/build-support/fetchsvn/default.nix
@@ -29,7 +29,8 @@ stdenv.mkDerivation {
 
   outputHashAlgo = if sha256 == "" then "md5" else "sha256";
   outputHashMode = "recursive";
-  outputHash = if sha256 == "" then md5 else sha256;
+  outputHash = if sha256 == "" then
+    (stdenv.lib.fetchMD5warn "fetchsvn" url md5) else sha256;
   
   inherit url rev sshSupport openssh ignoreExternals;
 
diff --git a/pkgs/build-support/fetchsvnssh/default.nix b/pkgs/build-support/fetchsvnssh/default.nix
index 6c6c03d68732..2d151fad07cb 100644
--- a/pkgs/build-support/fetchsvnssh/default.nix
+++ b/pkgs/build-support/fetchsvnssh/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
 
   outputHashAlgo = if sha256 == "" then "md5" else "sha256";
   outputHashMode = "recursive";
-  outputHash = if sha256 == "" then md5 else sha256;
+  outputHash = if sha256 == "" then
+    (stdenv.lib.fetchMD5warn "fetchsvnssh" url md5) else sha256;
   
   sshSubversion = ./sshsubversion.exp;
   
diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index 00f485ce6975..2cc45ca4bbf2 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -112,7 +112,8 @@ if (!hasHash) then throw "Specify hash for fetchurl fixed-output derivation: ${s
   outputHashAlgo = if outputHashAlgo != "" then outputHashAlgo else
       if sha512 != "" then "sha512" else if sha256 != "" then "sha256" else if sha1 != "" then "sha1" else "md5";
   outputHash = if outputHash != "" then outputHash else
-      if sha512 != "" then sha512 else if sha256 != "" then sha256 else if sha1 != "" then sha1 else md5;
+      if sha512 != "" then sha512 else if sha256 != "" then sha256 else if sha1 != "" then sha1 else
+        (stdenv.lib.fetchMD5warn "fetchurl" (builtins.head urls_) md5);
 
   outputHashMode = if (recursiveHash || executable) then "recursive" else "flat";