Index: scripts/install.sh
===================================================================
--- scripts/install.sh	(revision 09a20614d32f962bf994ddb7f553313f20882b63)
+++ scripts/install.sh	(revision 12731019d77e218351815f0a5c1a89172ad0ce78)
@@ -142,5 +142,9 @@
   git -C "$KLONKT_DIR" remote set-url origin "$KLONKT_REPO"
   git -C "$KLONKT_DIR" fetch --depth 1 origin "$KLONKT_BRANCH"
-  git -C "$KLONKT_DIR" reset --hard "origin/$KLONKT_BRANCH"
+  # Reset to FETCH_HEAD, not origin/$KLONKT_BRANCH: a single-branch/shallow clone (or one
+  # originally on a different branch, e.g. main → stable) has no origin/<branch> tracking ref,
+  # so `reset --hard origin/stable` fails with "ambiguous argument". FETCH_HEAD always points
+  # at what we just fetched, regardless of refspec or which branch the clone started on.
+  git -C "$KLONKT_DIR" reset --hard FETCH_HEAD
 else
   [ -e "$KLONKT_DIR" ] && [ -n "$(ls -A "$KLONKT_DIR" 2>/dev/null)" ] && die "$KLONKT_DIR already exists and is not a git checkout. Pick --dir, or clean it up."
@@ -236,5 +240,5 @@
 B=\$(runuser -u ${KLONKT_USER} -- git -C "\$D" rev-parse HEAD 2>/dev/null || true)
 runuser -u ${KLONKT_USER} -- git -C "\$D" fetch --depth 1 origin ${KLONKT_BRANCH}
-runuser -u ${KLONKT_USER} -- git -C "\$D" reset --hard origin/${KLONKT_BRANCH}
+runuser -u ${KLONKT_USER} -- git -C "\$D" reset --hard FETCH_HEAD
 A=\$(runuser -u ${KLONKT_USER} -- git -C "\$D" rev-parse HEAD)
 if [ "\$B" = "\$A" ]; then