diff --git a/tests/vendor/vendor-toolkit.test.mjs b/tests/vendor/vendor-toolkit.test.mjs
index 1fbfe465..bfe777fe 100644
--- a/tests/vendor/vendor-toolkit.test.mjs
+++ b/tests/vendor/vendor-toolkit.test.mjs
@@ -45,3 +45,18 @@ test('toolkit sync rejects moving pins, identity mismatches and missing sources
     assert.throws(() => syncToolkit({ root: third.root }), /ENOENT/);
     assert.throws(() => readFileSync(join(third.destination, 'core.js')), /ENOENT/);
 });
+
+test('toolkit sync rejects lookalike download hosts and archive paths before writing', t => {
+    for (const prefix of [
+        'https://codeloadXgithub.com/ComfyAssets/ComfyAssets-Toolkit/tar.gz/',
+        'https://codeload.githubXcom/ComfyAssets/ComfyAssets-Toolkit/tar.gz/',
+        'https://codeload.github.com/ComfyAssets/ComfyAssets-Toolkit/tarXgz/',
+    ]) {
+        const f = fixture(t);
+        const resolved = prefix + 'a'.repeat(40);
+        writeFileSync(join(f.tooling, 'package.json'), JSON.stringify({ devDependencies: { '@comfyassets/toolkit': resolved } }));
+        writeFileSync(join(f.tooling, 'package-lock.json'), JSON.stringify({ packages: { 'node_modules/@comfyassets/toolkit': { version: '0.1.0', resolved, integrity: 'sha512-fixture' } } }));
+        assert.throws(() => syncToolkit({ root: f.root }), /immutable commit pin/);
+        assert.throws(() => readFileSync(join(f.destination, 'core.js')), /ENOENT/);
+    }
+});
diff --git a/tools/vendor/vendor-toolkit.mjs b/tools/vendor/vendor-toolkit.mjs
index 8e06dfbb..b48c8663 100644
--- a/tools/vendor/vendor-toolkit.mjs
+++ b/tools/vendor/vendor-toolkit.mjs
@@ -8,7 +8,7 @@ export function syncToolkit({ root = repositoryRoot, check = false } = {}) {
     const tooling = join(root, 'tools/vendor');
     const readJson = path => JSON.parse(readFileSync(path, 'utf8'));
     const pin = readJson(join(tooling, 'package.json')).devDependencies['@comfyassets/toolkit'];
-    if (!/^https:\/\/codeload.github.com\/ComfyAssets\/ComfyAssets-Toolkit\/tar.gz\/[a-f0-9]{40}$/.test(pin)) throw new Error('Toolkit needs an immutable commit pin');
+    if (!/^https:\/\/codeload\.github\.com\/ComfyAssets\/ComfyAssets-Toolkit\/tar\.gz\/[a-f0-9]{40}$/.test(pin)) throw new Error('Toolkit needs an immutable commit pin');
     const locked = readJson(join(tooling, 'package-lock.json')).packages['node_modules/@comfyassets/toolkit'];
     const installed = join(tooling, 'node_modules/@comfyassets/toolkit');
     const info = readJson(join(installed, 'package.json'));