diff --git a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/RegistryAccessRecorder.java b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/RegistryAccessRecorder.java
index 23658eb2864e0a..114195ee637731 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/RegistryAccessRecorder.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/RegistryAccessRecorder.java
@@ -29,10 +29,10 @@ public Optional<byte[]> downloadAndRecord(URI uri, Registry.Downloader downloade
       // Local files are out of scope for the lockfile.
       return downloader.download(uri, Optional.empty());
     }
+    // We use a two-step lookup below to avoid copying around the entries of the
+    // potentially large knownFiles map.
     Optional<Checksum> knownChecksum = knownFiles.get(uri);
     if (knownChecksum == null) {
-      // This should never happen since every file is only ever downloaded once,
-      // but just in case, we'll check the requested files as well.
       knownChecksum = requestedFiles.get(uri);
     }
 
diff --git a/src/test/py/bazel/bzlmod/bazel_lockfile_test.py b/src/test/py/bazel/bzlmod/bazel_lockfile_test.py
index 20dbde8f37adca..635ee255483a29 100644
--- a/src/test/py/bazel/bzlmod/bazel_lockfile_test.py
+++ b/src/test/py/bazel/bzlmod/bazel_lockfile_test.py
@@ -145,6 +145,39 @@ def testChangeModuleInRegistryWithLockfile(self):
     # Even adding a new dependency should not fail due to the registry change
     self.RunBazel(['build', '--nobuild', '//:all'])
 
+  def testAddModuleToRegistryWithLockfile(self):
+    # Create a project with deps on the BCR's 'platforms' module
+    self.ScratchFile(
+        'MODULE.bazel',
+        [
+            'bazel_dep(name = "platforms", version = "0.0.9")',
+        ],
+    )
+    self.ScratchFile('BUILD', ['filegroup(name = "hello")'])
+    self.RunBazel(['build', '--nobuild', '//:all'])
+
+    # Add a broken 'platforms' module to the first registry
+    module_dir = self.main_registry.root.joinpath('modules', 'platforms', '0.0.9')
+    scratchFile(module_dir.joinpath('MODULE.bazel'), ['whatever!'])
+
+    # Shutdown bazel to empty any cache of the deps tree
+    self.RunBazel(['shutdown'])
+    # Running with the lockfile, should not recognize the registry changes
+    # hence find no errors
+    self.RunBazel(['build', '--nobuild', '//:all'])
+
+    self.ScratchFile(
+        'MODULE.bazel',
+        [
+            'bazel_dep(name = "platforms", version = "0.0.9")',
+            'bazel_dep(name = "bbb", version = "1.1")',
+        ],
+    )
+    # Shutdown bazel to empty any cache of the deps tree
+    self.RunBazel(['shutdown'])
+    # Even adding a new dependency should not fail due to the registry change
+    self.RunBazel(['build', '--nobuild', '//:all'])
+
   def testChangeFlagWithLockfile(self):
     # Create a project with an outdated direct dep on aaa
     self.ScratchFile(