diff --git a/internal/mod/modload/testdata/updateversions/issue3499.txtar b/internal/mod/modload/testdata/updateversions/issue3499.txtar
new file mode 100644
index 00000000000..6db75273fb3
--- /dev/null
+++ b/internal/mod/modload/testdata/updateversions/issue3499.txtar
@@ -0,0 +1,41 @@
+# Test that adding a new dependency which goes before an existing one
+# does not panic due to an unsorted list of module versions.
+-- versions --
+bar.com
+-- want --
+module: "main.org@v0"
+language: {
+	version: "v0.8.0"
+}
+deps: {
+	"bar.com@v0": {
+		v: "v0.0.1"
+	}
+	"foo.com@v0": {
+		v: "v0.0.1"
+	}
+}
+-- cue.mod/module.cue --
+module: "main.org@v0"
+language: version: "v0.8.0"
+deps: {
+	"foo.com@v0": {
+		v: "v0.0.1"
+	}
+}
+-- main.cue --
+package main
+
+-- _registry/foo.com_v0.0.1/cue.mod/module.cue --
+module: "foo.com@v0"
+language: version: "v0.8.0"
+
+-- _registry/foo.com_v0.0.1/foo/x.cue --
+package foo
+
+-- _registry/bar.com_v0.0.1/cue.mod/module.cue --
+module: "bar.com@v0"
+language: version: "v0.8.0"
+
+-- _registry/bar.com_v0.0.1/bar/x.cue --
+package bar
diff --git a/internal/mod/modload/update.go b/internal/mod/modload/update.go
index 28b117811e6..5bc585cb271 100644
--- a/internal/mod/modload/update.go
+++ b/internal/mod/modload/update.go
@@ -73,6 +73,7 @@ func UpdateVersions(ctx context.Context, fsys fs.FS, modRoot string, reg Registr
 	for _, v := range mversionsMap {
 		newVersions = append(newVersions, v)
 	}
+	module.Sort(newVersions)
 	rs = modrequirements.NewRequirements(mf.QualifiedModule(), reg, newVersions, mf.DefaultMajorVersions())
 	g, err = rs.Graph(ctx)
 	if err != nil {