diff --git a/scripts/installtests/build_release_assets_test.go b/scripts/installtests/build_release_assets_test.go
index 35f78d8f8..17be82c29 100644
--- a/scripts/installtests/build_release_assets_test.go
+++ b/scripts/installtests/build_release_assets_test.go
@@ -317,6 +317,10 @@ func TestReleaseValidationRequiresSignedSidecars(t *testing.T) {
 		`http_header_value "X-Checksum-Sha256"`,
 		`http_header_value "X-Signature-Ed25519"`,
 		`http_header_value "X-Signature-SSHSIG"`,
+		`url="http://127.0.0.1:${HOST_PORT}/${script_name}"`,
+		`^# Pulse Unified Agent Installer`,
+		`--token-file`,
+		`TokenFile`,
 		`Install script endpoints returned required signature headers`,
 		`Download endpoints returned binaries with checksum and signature headers for all platforms/architectures`,
 		`Offline self-heal: download endpoint works with checksum and signature headers without outbound network`,
@@ -374,6 +378,9 @@ func TestReleaseValidationRequiresSignedSidecars(t *testing.T) {
 			t.Fatalf("validate-release.sh missing signed sidecar validation: %s", needle)
 		}
 	}
+	if strings.Contains(localValidator, `url="http://127.0.0.1:${HOST_PORT}/download/${script_name}"`) {
+		t.Fatal("validate-release.sh must smoke-test /install.sh and /install.ps1, not non-existent /download/install.* routes")
+	}
 
 	publishedValidatorBytes, err := os.ReadFile(repoFile("scripts", "validate-published-release.sh"))
 	if err != nil {
diff --git a/scripts/validate-release.sh b/scripts/validate-release.sh
index 83b113433..19ceb9087 100755
--- a/scripts/validate-release.sh
+++ b/scripts/validate-release.sh
@@ -270,7 +270,7 @@ if [ "$SKIP_DOCKER" = false ]; then
     )
 
     for script_name in install.sh install.ps1; do
-        url="http://127.0.0.1:${HOST_PORT}/download/${script_name}"
+        url="http://127.0.0.1:${HOST_PORT}/${script_name}"
         tmp_file=$(mktemp)
         tmp_headers=$(mktemp)
         if ! curl -fsS -D "$tmp_headers" -o "$tmp_file" "$url"; then
@@ -282,6 +282,28 @@ if [ "$SKIP_DOCKER" = false ]; then
             error "Downloaded empty ${script_name}"
             exit 1
         fi
+        case "$script_name" in
+            install.sh)
+                if ! grep -q '^# Pulse Unified Agent Installer' "$tmp_file"; then
+                    error "${script_name} endpoint did not return the unified agent installer"
+                    exit 1
+                fi
+                if ! grep -q -- '--token-file' "$tmp_file"; then
+                    error "${script_name} endpoint is missing agent installer token-file support"
+                    exit 1
+                fi
+                ;;
+            install.ps1)
+                if ! grep -q '^# Pulse Unified Agent Installer (Windows)' "$tmp_file"; then
+                    error "${script_name} endpoint did not return the unified agent installer"
+                    exit 1
+                fi
+                if ! grep -q 'TokenFile' "$tmp_file"; then
+                    error "${script_name} endpoint is missing agent installer token-file support"
+                    exit 1
+                fi
+                ;;
+        esac
         validate_download_script_headers "$tmp_headers" "${script_name}"
         rm -f "$tmp_file" "$tmp_headers"
     done