diff --git a/scripts/test_install.sh b/scripts/test_install.sh
new file mode 100755
index 0000000..4b3cbc6
--- /dev/null
+++ b/scripts/test_install.sh
@@ -0,0 +1,185 @@
+#!/bin/bash
+# test_install.sh - Test the install.sh script logic
+#
+# Tests version detection, URL construction, and error handling
+# without requiring a published release.
+#
+# Usage:
+#   ./scripts/test_install.sh
+#
+# Set GREYWALL_TEST_INSTALL_LIVE=1 to also test against a real release
+# (requires a published release on Gitea).
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INSTALL_SCRIPT="$SCRIPT_DIR/../install.sh"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+PASSED=0
+FAILED=0
+SKIPPED=0
+
+pass() { echo -e "Testing: $1... ${GREEN}PASS${NC}"; PASSED=$((PASSED + 1)); }
+fail() { echo -e "Testing: $1... ${RED}FAIL${NC} ($2)"; FAILED=$((FAILED + 1)); }
+skip() { echo -e "Testing: $1... ${YELLOW}SKIPPED${NC} ($2)"; SKIPPED=$((SKIPPED + 1)); }
+
+echo "Install script: $INSTALL_SCRIPT"
+echo "=============================================="
+
+# ============================================================
+echo ""
+echo "=== Script Sanity ==="
+echo ""
+
+# Script exists and is executable
+if [[ -f "$INSTALL_SCRIPT" ]]; then
+    pass "install.sh exists"
+else
+    fail "install.sh exists" "file not found at $INSTALL_SCRIPT"
+fi
+
+if sh -n "$INSTALL_SCRIPT" 2>/dev/null; then
+    pass "install.sh has valid shell syntax"
+else
+    fail "install.sh has valid shell syntax" "syntax error reported by sh -n"
+fi
+
+# ============================================================
+echo ""
+echo "=== Version Detection ==="
+echo ""
+
+# No releases → must fail with clean error (not malformed URL garbage)
+output=$(sh "$INSTALL_SCRIPT" 2>&1) || true
+if echo "$output" | grep -q "Error: Unable to determine version to install"; then
+    pass "no releases → clean error message"
+elif echo "$output" | grep -q "Not found\|null\|undefined"; then
+    fail "no releases → clean error message" "leaked raw API/HTTP response: $output"
+else
+    # Could be passing if a real release now exists — check if it downloaded correctly
+    if echo "$output" | grep -q "installed successfully"; then
+        pass "no releases → clean error message (release exists, install succeeded)"
+    else
+        fail "no releases → clean error message" "unexpected output: $output"
+    fi
+fi
+
+# Explicit version arg (v-prefixed) → used as-is
+output=$(sh "$INSTALL_SCRIPT" v99.0.0 2>&1) || true
+if echo "$output" | grep -q "v99.0.0"; then
+    pass "explicit version (v-prefixed) passed through"
+else
+    fail "explicit version (v-prefixed) passed through" "version not found in output: $output"
+fi
+
+# Explicit version arg (no v prefix) → v added automatically
+output=$(sh "$INSTALL_SCRIPT" 99.0.0 2>&1) || true
+if echo "$output" | grep -q "v99.0.0"; then
+    pass "explicit version (no v-prefix) gets v added"
+else
+    fail "explicit version (no v-prefix) gets v added" "output: $output"
+fi
+
+# GREYWALL_VERSION env var respected
+output=$(GREYWALL_VERSION=99.1.0 sh "$INSTALL_SCRIPT" 2>&1) || true
+if echo "$output" | grep -q "v99.1.0"; then
+    pass "GREYWALL_VERSION env var respected"
+else
+    fail "GREYWALL_VERSION env var respected" "output: $output"
+fi
+
+# ============================================================
+echo ""
+echo "=== URL Construction ==="
+echo ""
+
+# Download URL must point to Gitea, not GitHub
+output=$(sh "$INSTALL_SCRIPT" v1.2.3 2>&1) || true
+if echo "$output" | grep -q "gitea.app.monadical.io"; then
+    pass "download URL uses Gitea host"
+else
+    fail "download URL uses Gitea host" "output: $output"
+fi
+
+if echo "$output" | grep -q "github.com"; then
+    fail "download URL does not use GitHub" "found github.com in output: $output"
+else
+    pass "download URL does not use GitHub"
+fi
+
+# URL contains the version, binary name, OS, and arch
+OS_TITLE="Linux"
+if [[ "$(uname -s)" == "Darwin" ]]; then OS_TITLE="Darwin"; fi
+ARCH="x86_64"
+if [[ "$(uname -m)" == "aarch64" || "$(uname -m)" == "arm64" ]]; then ARCH="arm64"; fi
+
+if echo "$output" | grep -q "greywall_1.2.3_${OS_TITLE}_${ARCH}.tar.gz"; then
+    pass "download URL has correct filename format"
+else
+    fail "download URL has correct filename format" "expected greywall_1.2.3_${OS_TITLE}_${ARCH}.tar.gz in: $output"
+fi
+
+# ============================================================
+echo ""
+echo "=== Error Handling ==="
+echo ""
+
+# Non-existent version → curl 404 → clean error, no crash
+output=$(sh "$INSTALL_SCRIPT" v0.0.0-nonexistent 2>&1) || true
+if echo "$output" | grep -q "Error: Failed to download release"; then
+    pass "non-existent version → clean download error"
+else
+    fail "non-existent version → clean download error" "output: $output"
+fi
+
+# ============================================================
+echo ""
+echo "=== Live Install (optional) ==="
+echo ""
+
+if [[ "${GREYWALL_TEST_INSTALL_LIVE:-}" == "1" ]]; then
+    # Check a release actually exists before attempting live install
+    LATEST_TAG=$(curl -s "https://gitea.app.monadical.io/api/v1/repos/monadical/greywall/releases/latest" \
+        2>/dev/null | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/' || echo "")
+    case "$LATEST_TAG" in
+        v[0-9]*)
+            TMP_BIN=$(mktemp -d)
+            trap 'rm -rf "$TMP_BIN"' EXIT
+            install_out=$(HOME="$TMP_BIN" sh "$INSTALL_SCRIPT" 2>&1) || true
+            if echo "$install_out" | grep -q "installed successfully"; then
+                if [[ -x "$TMP_BIN/.local/bin/greywall" ]]; then
+                    pass "live install: binary downloaded and executable"
+                    version_out=$("$TMP_BIN/.local/bin/greywall" --version 2>&1)
+                    if echo "$version_out" | grep -qE '^greywall v?[0-9]'; then
+                        pass "live install: binary runs and reports version"
+                    else
+                        fail "live install: binary runs and reports version" "output: $version_out"
+                    fi
+                else
+                    fail "live install: binary downloaded and executable" "binary not found at $TMP_BIN/.local/bin/greywall"
+                fi
+            else
+                fail "live install: install succeeded" "output: $install_out"
+            fi
+            ;;
+        *)
+            skip "live install (download + run binary)" "no releases published on Gitea yet"
+            ;;
+    esac
+else
+    skip "live install (download + run binary)" "set GREYWALL_TEST_INSTALL_LIVE=1 to enable"
+fi
+
+# ============================================================
+echo ""
+echo "=============================================="
+echo ""
+echo -e "Results: ${GREEN}$PASSED passed${NC}, ${RED}$FAILED failed${NC}, ${YELLOW}$SKIPPED skipped${NC}"
+echo ""
+
+[[ $FAILED -eq 0 ]]
\ No newline at end of file