In my case the issue turned out to be export-subst in .gitattributes of the input repo (used e.g. by python-versioneer). Looking at the store path of the input, I found the string
(HEAD -> main)
indicating that the current commit is the HEAD of the main branch, which is definitely not reproducible. I posted a minimal reproduction here: How to deal with unstable flake input hashes due to export-subst?