diff --git a/README.md b/README.md
index 943af2f..6b20d49 100644
--- a/README.md
+++ b/README.md
@@ -3,8 +3,9 @@
 One composite action for the three-step block every Flutter CI job repeats:
 install Flutter, restore the pub cache, run `flutter pub get`. Wraps
 [subosito/flutter-action](https://github.com/subosito/flutter-action) and
-[actions/cache](https://github.com/actions/cache), with both caches keyed on
-`pubspec.yaml`.
+[actions/cache](https://github.com/actions/cache). The Flutter SDK cache is keyed
+on `pubspec.yaml`, while the pub package cache is keyed on both `pubspec.yaml`
+and `pubspec.lock`.
 
 ## Usage
 
diff --git a/action.yml b/action.yml
index f27e812..0e68477 100644
--- a/action.yml
+++ b/action.yml
@@ -1,5 +1,5 @@
 name: Setup Flutter with pub cache
-description: Install Flutter, restore the pub cache keyed on pubspec.yaml, and run flutter pub get, as a single step.
+description: Install Flutter, restore the pub cache keyed on pubspec.yaml and pubspec.lock, and run flutter pub get, as a single step.
 branding:
   icon: download
   color: blue
@@ -36,7 +36,7 @@ runs:
         # instead misses the real cache directory on Windows runners, where
         # Flutter writes pub packages to %LOCALAPPDATA%\Pub\Cache by default.
         path: ${{ env.PUB_CACHE }}
-        key: ${{ runner.os }}-pub-${{ hashFiles('pubspec.yaml') }}
+        key: ${{ runner.os }}-pub-${{ hashFiles('pubspec.yaml', 'pubspec.lock') }}
         restore-keys: |
           ${{ runner.os }}-pub-