diff --git a/hack/bootstrap.sh b/hack/bootstrap.sh
index fa63117..c63781d 100755
--- a/hack/bootstrap.sh
+++ b/hack/bootstrap.sh
@@ -23,6 +23,7 @@ run() {
     clone_required_repos_ask_ssh_or_https
     local tag
     tag="${BASEIMAGE_ONLY:-$(remotebase="${REMOTEBASE}" baseimage_latest_upstream_tag)}"
+    tag=${tag} verify_baseimage_tag
     tag=${tag} build_baseimage
 
     if [ -z "${BASEIMAGE_ONLY:-}" ]; then
@@ -105,14 +106,6 @@ clone_required_repos() {
     echo "Done!"
 }
 
-install_frontend_deps() {
-    echo -n "Installing frontend dependencies... "
-    pushd "${FRONTEND_REPO}"
-    spinned logged yarn install
-    popd
-    echo "Done!"
-}
-
 baseimage_latest_upstream_tag() {
     echo -n "$(git ls-remote --tags ${remotebase}/${BASEIMAGE_REPO}.git |
                cut -f2                                                  |
@@ -121,6 +114,18 @@ baseimage_latest_upstream_tag() {
                tail -n 1)"
 }
 
+verify_baseimage_tag() {
+    pushd "${BASEIMAGE_REPO}"
+    local statuscode
+    if ! git rev-parse --quiet  \
+                       --verify \
+                       "refs/tags/${tag}" &> /dev/null; then
+        logged echo "${tag} is not a valid tag!"
+        exit 1
+    fi
+    popd
+}
+
 pin_baseimage() {
     echo -n "Pinning TFW baseimage version... "
     echo -n "which is ${tag}... "
@@ -137,6 +142,14 @@ build_baseimage() {
     echo "Done!"
 }
 
+install_frontend_deps() {
+    echo -n "Installing frontend dependencies... "
+    pushd "${FRONTEND_REPO}"
+    spinned logged yarn install
+    popd
+    echo "Done!"
+}
+
 cleanup_repos() {
     rm -rf "${BASEIMAGE_REPO}"
     rm -rf "${CHALLENGE}/.git"