diff --git a/apps/nesdoctor/README.md b/apps/nesdoctor/README.md
index d9d714b9..7a256391 100644
--- a/apps/nesdoctor/README.md
+++ b/apps/nesdoctor/README.md
@@ -16,6 +16,10 @@ install nothing, need no administrator rights, and touch no system directory.
 worker fetches them from this repository, so you can read exactly what you are
 about to run before you run it.
 
+They pin a release tag rather than using `releases/latest`, because this
+repository ships product releases too and `latest` is whichever went out most
+recently. `NESDOCTOR_TAG` overrides it.
+
 Or build it yourself:
 
 ```
diff --git a/apps/nesdoctor/install/install.ps1 b/apps/nesdoctor/install/install.ps1
index c650cb7a..a34a116d 100644
--- a/apps/nesdoctor/install/install.ps1
+++ b/apps/nesdoctor/install/install.ps1
@@ -17,7 +17,15 @@ $ErrorActionPreference = 'Stop'
 Set-StrictMode -Version Latest
 
 $Repo = 'nestrilabs/nestri'
-$Tag  = $env:NESDOCTOR_TAG
+
+# Pinned, and NOT `releases/latest`. This repository ships product releases as
+# well as this tool, so `latest` is whatever went out most recently -- it
+# resolved to a 2024 release while this was being written, and the day a
+# product release goes out it would move again and every install here would
+# 404. Bump this line when cutting a nesdoctor release; NESDOCTOR_TAG overrides
+# it for testing.
+$DefaultTag = 'nesdoctor-v0.1.0'
+$Tag = if ($env:NESDOCTOR_TAG) { $env:NESDOCTOR_TAG } else { $DefaultTag }
 
 # TLS 1.2 explicitly: Windows PowerShell 5.1 still defaults to older protocols
 # on some builds, and GitHub refuses them, which surfaces as a bare
@@ -31,11 +39,7 @@ if ($arch -ne 'x86_64') {
 $target = 'x86_64-pc-windows-msvc'
 $asset  = "nesdoctor-$target.exe"
 
-$base = if ($Tag) {
-  "https://github.com/$Repo/releases/download/$Tag"
-} else {
-  "https://github.com/$Repo/releases/latest/download"
-}
+$base = "https://github.com/$Repo/releases/download/$Tag"
 
 $tmp = Join-Path ([IO.Path]::GetTempPath()) ("nesdoctor-" + [Guid]::NewGuid().ToString('N'))
 New-Item -ItemType Directory -Path $tmp | Out-Null
diff --git a/apps/nesdoctor/install/install.sh b/apps/nesdoctor/install/install.sh
index 160c0e81..4cb5b153 100755
--- a/apps/nesdoctor/install/install.sh
+++ b/apps/nesdoctor/install/install.sh
@@ -16,7 +16,15 @@
 set -eu
 
 REPO="nestrilabs/nestri"
-TAG="${NESDOCTOR_TAG:-}"          # empty means latest
+
+# Pinned, and NOT `releases/latest`. This repository ships product releases as
+# well as this tool, so `latest` is whatever went out most recently -- it
+# resolved to a 2024 release while this was being written, and the day a
+# product release goes out it would move again and every install here would
+# 404. Bump this line when cutting a nesdoctor release; `NESDOCTOR_TAG`
+# overrides it for testing.
+DEFAULT_TAG="nesdoctor-v0.1.0"
+TAG="${NESDOCTOR_TAG:-$DEFAULT_TAG}"
 TMP="$(mktemp -d)"
 trap 'rm -rf "$TMP"' EXIT INT TERM
 
@@ -60,14 +68,10 @@ else
   die "need curl or wget"
 fi
 
-if [ -n "$TAG" ]; then
-  BASE="https://github.com/$REPO/releases/download/$TAG"
-else
-  BASE="https://github.com/$REPO/releases/latest/download"
-fi
+BASE="https://github.com/$REPO/releases/download/$TAG"
 
 say "Downloading nesdoctor ($target)…"
-get "$BASE/$ASSET" "$TMP/$ASSET" || die "download failed. Is there a release yet? $BASE/$ASSET"
+get "$BASE/$ASSET" "$TMP/$ASSET" || die "download failed: $BASE/$ASSET\n  If $TAG is not published yet, that is why."
 
 # --- verify -----------------------------------------------------------------
 # A checksum we fetch from the same place as the binary is not a security