diff --git a/.gitea/README.md b/.gitea/README.md
index fbae199..9f320db 100644
--- a/.gitea/README.md
+++ b/.gitea/README.md
@@ -173,8 +173,11 @@ Pterodactyl is responsible for Java, server process management and resources.
 
 Kubernetes/SWS provides static hosting for the published Packwiz repositories.
 The publishing workflow runs [`scripts/build-site.sh`](../scripts/build-site.sh),
-which exports committed Git revisions into the documented URL layout, then
-builds the multi-architecture image
+which exports committed Git revisions into the documented URL layout. Source
+packs intentionally keep `no-internal-hashes = true`; the workflow runs
+`packwiz refresh --build` only against the exported copies under `.build/site`
+so the image contains installer-ready hashes without committing generated hash
+churn. It then builds the multi-architecture image
 `tea.ahmza.com/ahmza.com/mcpacks-site`.
 
 The workflow finally commits that image's immutable OCI digest to
diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 11a6514..1a61038 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -36,6 +36,17 @@ jobs:
         # explicitly ensures /dev still contains today's development branch.
         run: git fetch origin main:refs/remotes/origin/main --tags --force
 
+      - name: Set up Go for Packwiz
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.23.x"
+          cache: false
+
+      - name: Install pinned Packwiz
+        # Packwiz has no stable binary release channel. Pinning the source
+        # revision makes image builds reproducible instead of following latest.
+        run: go install github.com/packwiz/packwiz@dfd8b68a4796c763e25bad50265ea1f1233e24f1
+
       - name: Assemble static Packwiz site
         env:
           EVENT_REF: ${{ gitea.ref }}
@@ -50,8 +61,13 @@ jobs:
             refs/tags/*) dev_ref=origin/main ;;
             *)           dev_ref=$EVENT_SHA ;;
           esac
-          ./scripts/build-site.sh "$dev_ref"
+          PACKWIZ_BIN="$(go env GOPATH)/bin/packwiz" \
+            ./scripts/build-site.sh "$dev_ref"
           test -s .build/site/forever/dev/pack.toml
+          grep -q '^hash = "[0-9a-f]\{64\}"$' \
+            .build/site/forever/dev/pack.toml
+          # Building distribution metadata must not alter tracked source packs.
+          git diff --exit-code -- forever playground
 
       - name: Verify tagged release output
         if: startsWith(gitea.ref, 'refs/tags/')
diff --git a/scripts/build-site.sh b/scripts/build-site.sh
index 4fa5441..b22b613 100755
--- a/scripts/build-site.sh
+++ b/scripts/build-site.sh
@@ -8,10 +8,16 @@ repo_root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
 cd "$repo_root"
 
 dev_ref=${1:-HEAD}
+packwiz_bin=${PACKWIZ_BIN:-packwiz}
 build_root="$repo_root/.build"
 site_root="$build_root/site"
 work_root="$build_root/work"
 
+if ! command -v "$packwiz_bin" >/dev/null 2>&1; then
+  echo "Packwiz executable not found: $packwiz_bin" >&2
+  exit 1
+fi
+
 rm -rf "$site_root" "$work_root"
 mkdir -p "$site_root/forever/releases" "$work_root"
 
@@ -30,6 +36,13 @@ export_pack() {
 
   git archive "$revision" "$pack" | tar -x -C "$scratch"
   mv "$scratch/$pack" "$destination"
+
+  # Source packs intentionally omit internal hashes. Generate the distributable
+  # index only in the ephemeral image-build tree, never in the Git checkout.
+  (
+    cd "$destination"
+    "$packwiz_bin" refresh --build
+  )
 }
 
 # main is always the development source, including when this script runs for a