GitHub Actions caching not invalidating on dependency changes

Set up dependency caching for npm/pip in Actions. Works great until it doesn't — cache hits even when package.json/requirements.txt changed. Tried hashFiles() but it's inconsistent. How do you guarantee cache invalidation when deps change but lockfile hasn't?