pip install --require-hashes -r requirements.txt is all or nothing. Once any requirement carries a --hash option, pip switches the whole install into hash-checking mode and rejects the run unless every requirement, including every transitive dependency, is pinned to an exact version with == and carries at least one hash.
The errors are specific. A missing pin gives Hashes are required in --require-hashes mode, but they are missing from some requirements, and an unpinned dependency gives a message naming the package that lacks a hash. A requirement pinned with ~= or a range is rejected even if it has a hash, because a range cannot be verified in advance.
Generate the file rather than maintaining it: pip-compile --generate-hashes from pip-tools, or uv export --format requirements-txt which emits hashes by default for a locked project. Note that hash mode also disallows editable installs and any requirement that pip would have to build to discover metadata, so local path dependencies need to be built into wheels first.