diff --git a/manifest/line-based.go b/manifest/line-based.go
index ad79b92..1d7fe54 100644
--- a/manifest/line-based.go
+++ b/manifest/line-based.go
@@ -7,6 +7,8 @@ import (
 	"strings"
 )
 
+const DefaultLineBasedFetch = "refs/heads/*" // backwards compatibility
+
 // TODO write more of a proper parser? (probably not worthwhile given that 2822 is the preferred format)
 func ParseLineBasedLine(line string, defaults Manifest2822Entry) (*Manifest2822Entry, error) {
 	entry := defaults.Clone()
@@ -29,6 +31,12 @@ func ParseLineBasedLine(line string, defaults Manifest2822Entry) (*Manifest2822E
 		entry.Directory = strings.TrimSpace(parts[1])
 	}
 
+	if entry.GitFetch == DefaultLineBasedFetch && !GitCommitRegex.MatchString(entry.GitCommit) {
+		// doesn't look like a commit, must be a tag
+		entry.GitFetch = "refs/tags/" + entry.GitCommit
+		entry.GitCommit = "FETCH_HEAD"
+	}
+
 	return &entry, nil
 }
 
@@ -39,7 +47,7 @@ func ParseLineBased(readerIn io.Reader) (*Manifest2822, error) {
 		Global: DefaultManifestEntry.Clone(),
 	}
 	manifest.Global.Maintainers = []string{`TODO parse old-style "maintainer:" comment lines?`}
-	manifest.Global.GitFetch = "refs/heads/*" // backwards compatibility
+	manifest.Global.GitFetch = DefaultLineBasedFetch
 
 	for {
 		line, err := reader.ReadString('\n')
diff --git a/manifest/rfc2822.go b/manifest/rfc2822.go
index 9b0ba0d..30212f3 100644
--- a/manifest/rfc2822.go
+++ b/manifest/rfc2822.go
@@ -12,6 +12,11 @@ import (
 	"pault.ag/go/debian/control"
 )
 
+var (
+	GitCommitRegex = regexp.MustCompile(`^[0-9a-f]{1,40}$`)
+	GitFetchRegex  = regexp.MustCompile(`^refs/(heads|tags)/[^*?:]+$`)
+)
+
 type Manifest2822 struct {
 	Global  Manifest2822Entry
 	Entries []Manifest2822Entry
@@ -247,6 +252,12 @@ func Parse2822(readerIn io.Reader) (*Manifest2822, error) {
 		if entry.GitRepo == "" || entry.GitFetch == "" || entry.GitCommit == "" {
 			return nil, fmt.Errorf("Tags %q missing one of GitRepo, GitFetch, or GitCommit", entry.TagsString())
 		}
+		if !GitFetchRegex.MatchString(entry.GitFetch) {
+			return nil, fmt.Errorf(`Tags %q has invalid GitFetch (must be "refs/heads/..." or "refs/tags/..."): %q`, entry.TagsString(), entry.GitFetch)
+		}
+		if !GitCommitRegex.MatchString(entry.GitCommit) {
+			return nil, fmt.Errorf(`Tags %q has invalid GitCommit (must be a commit, not a tag or ref): %q`, entry.TagsString(), entry.GitCommit)
+		}
 
 		err = manifest.AddEntry(entry)
 		if err != nil {