diff --git a/deploy/install.sh b/deploy/install.sh
index 9456ae6..991bf4c 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -166,6 +166,22 @@ else
     chown "$APP_USER" "$askpass"
     trap 'rm -f "$askpass"' EXIT
 
+    # Ask what is actually there before cloning. Without this, a BRANCH that
+    # does not exist fails inside git with "Remote branch not found", which
+    # reads like a broken token or an unreachable server — and the branch is
+    # the one thing here that is routinely wrong.
+    remote_heads="$(GIT_ASKPASS="$askpass" GIT_TERMINAL_PROMPT=0 \
+        as_app git ls-remote --heads "${REPO_URL/https:\/\//https://oauth2@}" 2>/dev/null \
+        | sed 's|.*refs/heads/||')" \
+        || die "Could not reach ${REPO_URL}. Check the server and the token."
+
+    if ! grep -qxF "$BRANCH" <<<"$remote_heads"; then
+        die "The repository has no branch '${BRANCH}'. It has:
+$(sed 's/^/    /' <<<"$remote_heads")
+
+  Pass the one you want:  BRANCH=<name> bash install.sh"
+    fi
+
     GIT_ASKPASS="$askpass" GIT_TERMINAL_PROMPT=0 \
         as_app git clone --quiet --branch "$BRANCH" "${REPO_URL/https:\/\//https://oauth2@}" "$INSTALL_DIR"