I mean, the change you mentioned Benjy explains it all I think. Since there is no symlink, a VCS clone is happening every time. Pex does not trust any VCS URL to be stable and so both Pip cloning the repo and checking out the given branch, tag or commit happens every time, and then Pex sha256 hasing that repo tree happens every time to confirm no float.