diff --git a/install.sh b/install.sh
index 7eb2554..5a6ad68 100755
--- a/install.sh
+++ b/install.sh
@@ -9,7 +9,7 @@ PROJECT_REPO_URL="${PROJECT_REPO_URL:-https://github.com/basefoundry/base-demo.g
 WORKSPACE_DIR="${WORKSPACE_DIR:-$HOME/work}"
 BASE_DIR="${BASE_DIR:-$WORKSPACE_DIR/base}"
 PROJECT_DIR="${PROJECT_DIR:-$WORKSPACE_DIR/$PROJECT_NAME}"
-BASE_INSTALL_URL="${BASE_INSTALL_URL:-https://raw.githubusercontent.com/basefoundry/base/master/install.sh}"
+BASE_INSTALL_URL="${BASE_INSTALL_URL:-https://raw.githubusercontent.com/basefoundry/base/HEAD/install.sh}"
 RUN_UPDATE_PROFILE="${RUN_UPDATE_PROFILE:-true}"
 
 INSTALLER_TMP=""
diff --git a/tests/validate.sh b/tests/validate.sh
index 2ea37fa..2496eb8 100755
--- a/tests/validate.sh
+++ b/tests/validate.sh
@@ -134,6 +134,11 @@ if [[ -n "$stale_github_refs" ]]; then
   exit 1
 fi
 
+if grep -Fq 'raw.githubusercontent.com/basefoundry/base/master/' install.sh; then
+  printf 'install.sh must not use Base master branch raw URLs.\n' >&2
+  exit 1
+fi
+
 grep -Fq 'hello: ./src/hello.sh' base_manifest.yaml || {
   printf 'base_manifest.yaml does not declare the hello command.\n' >&2
   exit 1