diff --git a/README.md b/README.md
index ffbd2eec0eb..aef43d0591d 100644
--- a/README.md
+++ b/README.md
@@ -301,7 +301,14 @@ Paperclip is a full control plane, not a wrapper. Before you build any of this y
 Open source. Self-hosted. No Paperclip account required.
 
 ```bash
-curl -fsSL https://paperclip.ing/install.sh | bash
+curl -fsSLO https://paperclip.ing/install.sh
+curl -fsSLO https://paperclip.ing/install.sh.sha256
+if command -v sha256sum >/dev/null 2>&1; then
+  sha256sum -c install.sh.sha256
+else
+  shasum -a 256 -c install.sh.sha256
+fi
+bash install.sh
 ```
 
 The installer ensures Node.js 20 or newer is available, installs a managed
diff --git a/doc/CLI.md b/doc/CLI.md
index 7d8984ce502..1898819c012 100644
--- a/doc/CLI.md
+++ b/doc/CLI.md
@@ -17,7 +17,14 @@ pnpm paperclipai --help
 Recommended installation and interactive onboarding:
 
 ```sh
-curl -fsSL https://paperclip.ing/install.sh | bash
+curl -fsSLO https://paperclip.ing/install.sh
+curl -fsSLO https://paperclip.ing/install.sh.sha256
+if command -v sha256sum >/dev/null 2>&1; then
+  sha256sum -c install.sh.sha256
+else
+  shasum -a 256 -c install.sh.sha256
+fi
+bash install.sh
 ```
 
 First-time local bootstrap from a source checkout:
diff --git a/doc/INSTALLING.md b/doc/INSTALLING.md
index 374ca739c4a..1222e1cb3dc 100644
--- a/doc/INSTALLING.md
+++ b/doc/INSTALLING.md
@@ -10,7 +10,14 @@ rollback, git-ref installs, and a stable entrypoint for the background service.
 On macOS, Linux, or WSL2:
 
 ```sh
-curl -fsSL https://paperclip.ing/install.sh | bash
+curl -fsSLO https://paperclip.ing/install.sh
+curl -fsSLO https://paperclip.ing/install.sh.sha256
+if command -v sha256sum >/dev/null 2>&1; then
+  sha256sum -c install.sh.sha256
+else
+  shasum -a 256 -c install.sh.sha256
+fi
+bash install.sh
 ```
 
 The bootstrap script:
diff --git a/scripts/install.sh b/scripts/install.sh
index c3cb6e31dc4..1d3c0c5967f 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -26,8 +26,9 @@ usage() {
 Install Paperclip on macOS, Linux, or WSL2.
 
 Usage:
-  curl -fsSL https://paperclip.ing/install.sh | bash
-  curl -fsSL https://paperclip.ing/install.sh | bash -s -- [options]
+  curl -fsSLO https://paperclip.ing/install.sh
+  bash install.sh [options]
+  curl -fsSL https://paperclip.ing/install.sh | bash -s -- --no-prompt [options]
 
 Options:
   --canary                 Install the canary channel
@@ -155,8 +156,8 @@ if [ -n "$REF" ] || [ -n "$REPO" ]; then
   fail "git-ref installs are not available in this installer build; omit --ref and --repo"
 fi
 
-if [ ! -t 0 ] || [ ! -t 1 ]; then
-  NO_PROMPT=1
+if { [ ! -t 0 ] || [ ! -t 1 ]; } && [ "$NO_PROMPT" != "1" ]; then
+  fail "non-interactive installation requires explicit --no-prompt; download the script first for interactive review"
 fi
 
 if [ "$VERBOSE" = "1" ]; then
diff --git a/scripts/test-install-sh-docker.sh b/scripts/test-install-sh-docker.sh
index b12d0d89580..35712581c27 100755
--- a/scripts/test-install-sh-docker.sh
+++ b/scripts/test-install-sh-docker.sh
@@ -101,6 +101,12 @@ fi
   exit 1
 }
 
+echo "==> piped mode requires explicit consent"
+if run_with_node piped-rejected bash -c 'cat /paperclip-scripts/install.sh | bash -s -- --no-onboard'; then
+  echo "Expected piped install without --no-prompt to fail" >&2
+  exit 1
+fi
+
 echo "==> piped --no-prompt"
 run_with_node piped bash -c 'cat /paperclip-scripts/install.sh | bash -s -- --no-prompt --no-onboard'
 assert_line "$RESULTS_DIR/piped.args" "--yes"