diff --git a/src/libfetchers/git.cc b/src/libfetchers/git.cc
index ee933992b4f..616fe93ba7b 100644
--- a/src/libfetchers/git.cc
+++ b/src/libfetchers/git.cc
@@ -858,8 +858,13 @@ struct GitInputScheme : InputScheme
 
         auto originalRef = input.getRef();
         bool shallow = canDoShallow(input);
-        auto ref = originalRef ? *originalRef : getDefaultRef(repoInfo, shallow);
-        input.attrs.insert_or_assign("ref", ref);
+
+        /* When a specific rev is requested without an explicit ref, don't
+           resolve the default ref (which would contact the remote). The
+           rev can be fetched directly by its hash. */
+        auto ref = originalRef ? *originalRef : !origRev ? getDefaultRef(repoInfo, shallow) : std::string{};
+        if (!ref.empty())
+            input.attrs.insert_or_assign("ref", ref);
 
         std::filesystem::path repoDir;
 
@@ -941,7 +946,7 @@ struct GitInputScheme : InputScheme
                 } catch (Error & e) {
                     warn("could not update mtime for file %s: %s", localRefFile, e.info().msg);
                 }
-                if (!originalRef && !storeCachedHead(repoUrl.to_string(), shallow, ref))
+                if (!originalRef && !ref.empty() && !storeCachedHead(repoUrl.to_string(), shallow, ref))
                     warn("could not update cached head '%s' for '%s'", ref, repoInfo.locationToArg());
             }
 
diff --git a/tests/functional/fetchGit.sh b/tests/functional/fetchGit.sh
index 1d8a8e75224..d93cfdccf67 100755
--- a/tests/functional/fetchGit.sh
+++ b/tests/functional/fetchGit.sh
@@ -161,6 +161,19 @@ git -C "$repo" commit -m 'Bla4'
 rev3=$(git -C "$repo" rev-parse HEAD)
 nix eval --tarball-ttl 3600 --expr "builtins.fetchGit { url = $repo; rev = \"$rev3\"; }" >/dev/null
 
+# Fetching a rev that is already cached should not hit the network,
+# even when the cached HEAD ref has expired (NixOS/nix#10773).
+export _NIX_FORCE_HTTP=1
+nix eval --expr "builtins.fetchGit { url = file://$repo; rev = \"$rev3\"; }" >/dev/null
+# Make the repo unavailable so any network access triggers a warning.
+mv "$repo" "${repo}"-tmp
+path6=$(nix eval --tarball-ttl 0 --raw --expr "(builtins.fetchGit { url = file://$repo; rev = \"$rev3\"; }).outPath" 2>"$TEST_ROOT/stderr-10773")
+[[ $(cat "$path6"/hello) = delft ]]
+# The old code would try to resolve HEAD here and emit this warning.
+(! grep -q "could not get HEAD ref" < "$TEST_ROOT/stderr-10773")
+mv "${repo}"-tmp "$repo"
+unset _NIX_FORCE_HTTP
+
 # Update 'path' to reflect latest master
 path=$(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).outPath")