diff --git a/mypy/util.py b/mypy/util.py
index d44e58da8fc3..f7c96e520f5c 100644
--- a/mypy/util.py
+++ b/mypy/util.py
@@ -476,7 +476,9 @@ def hash_digest(data: bytes) -> str:
     accidental collision, but we don't really care about any of the
     cryptographic properties.
     """
-    return hashlib.md5(data).hexdigest()
+    # Once we drop Python 3.5 support, we should consider using
+    # blake2b, which is faster.
+    return hashlib.sha256(data).hexdigest()
 
 
 class FancyFormatter: