After spending a bit of time on it, I ended up finding the source of the problem: the offending crate `bandersnatch_vrfs` pulls `ring-proof` from a github repo, and for some reason it pulls a wrong version sometimes.

I checked the version in `Cargo.toml` from the archived polkadot repo (in my case, I build on top of the archived v1, before the migration to the monorepo), and copy/pasted the correct hash for `ring-proof` in my `Cargo.toml` where needed:

    source = "git+https://github.com/w3f/ring-proof#0e948f3c28cbacecdd3020403c4841c0eb339213"