🚨 OpenTofu Error: 'Inconsistent dependency lock file' — Cause, Fix, and Troubleshooting Guide

Overview

OpenTofu pins the exact provider versions and checksums it selected in .terraform.lock.hcl. On every later run it enforces that lock. If your configuration now needs a provider or version the lock does not cover — or the lock has no checksum for the current OS/arch — tofu init stops:

Error: Inconsistent dependency lock file

The following dependency selections recorded in the lock file are inconsistent
with the current configuration:
  - provider registry.opentofu.org/hashicorp/aws: locked version selection
    5.40.0 doesn't match the updated version constraints "~> 5.60"

To update the locked dependency selections to match a changed configuration,
run:
  tofu init -upgrade

Symptoms

• tofu init (or plan/apply) fails with Inconsistent dependency lock file.
• The message names a provider whose locked version no longer satisfies required_providers.
• A variant reports no matching checksum for the current platform (linux_amd64 in CI, darwin_arm64 locally).
• It surfaces right after editing constraints, adding a provider, or moving between macOS and Linux/CI.

Common Root Causes

• Constraint changed — you edited required_providers but did not refresh the lock.
• New provider added with no entry in the lock file.
• Missing platform hashes — the lock was generated on one platform and lacks checksums for CI’s.
• Lock not committed — CI regenerates a different selection than local.
• Manual edits to .terraform.lock.hcl left it internally inconsistent.

How to diagnose

Read exactly which provider/constraint is inconsistent:

tofu init 2>&1 | sed -n '1,30p'

Inspect the lock’s current selections against your constraints:

cat .terraform.lock.hcl
grep -nA6 "required_providers" *.tf

Show what OpenTofu believes it requires:

tofu providers

Fixes

Reconcile the lock with the configuration:

tofu init -upgrade

Make the lock portable across every platform your team and CI use, so no checksum is missing:

tofu providers lock \
  -platform=linux_amd64 \
  -platform=darwin_arm64 \
  -platform=linux_arm64

Confirm it is clean and reproducible:

tofu init && tofu providers

If a hand-edit corrupted the lock, delete it and regenerate rather than patching by hand:

rm .terraform.lock.hcl
tofu init

What to watch out for

• Always commit .terraform.lock.hcl so local and CI resolve identical providers.
• Run tofu providers lock with every platform you deploy from; a single-platform lock breaks in CI.
• After changing required_providers, run tofu init -upgrade and commit the lock in the same change.
• Never hand-edit the lock file — regenerate it.
• Review lock diffs in code review; a surprise version bump is worth a second look.

Related

• OpenTofu Error: ‘Failed to query available provider packages’ — Cause, Fix, and Troubleshooting Guide
• OpenTofu Error: ‘Module not installed’ — Cause, Fix, and Troubleshooting Guide
• OpenTofu Error: ‘Invalid legacy provider address’ — Cause, Fix, and Troubleshooting Guide