diff --git a/arcup/arcup b/arcup/arcup
index 3590cd36..4141ee0e 100755
--- a/arcup/arcup
+++ b/arcup/arcup
@@ -6,7 +6,7 @@ set -euo pipefail
 
 # NOTE: if you make modifications to this script, please increment the version number.
 # WARNING: the SemVer pattern: major.minor.patch must be followed as we use it to determine if the script is up to date.
-ARCUP_INSTALLER_VERSION="0.2.0"
+ARCUP_INSTALLER_VERSION="0.2.1"
 
 REPO="${ARC_REPO:-circlefin/arc-node}"
 if [[ -n "${ARC_REPO:-}" ]] && [[ ! "$ARC_REPO" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
@@ -350,7 +350,7 @@ download_file_with_github_api() {
     download_url=$(resolve_github_asset_download_url "$asset_api_url") || return 1
 
     if curl "${CURL_RETRY_ARGS[@]}" -fL --max-time 900 -o "$output_path" "$download_url" >/dev/null 2>&1; then
-        [[ -f "$output_path" ]] && return 0
+        [[ -s "$output_path" ]] && return 0
     fi
 
     rm -f "$output_path"
@@ -838,4 +838,4 @@ main() {
 
 if [[ "${ARCUP_SKIP_MAIN:-}" != "1" ]]; then
     main
-fi
+fi
\ No newline at end of file
diff --git a/arcup/install b/arcup/install
index b9a8d2bf..6a98ecb5 100755
--- a/arcup/install
+++ b/arcup/install
@@ -72,7 +72,7 @@ main() {
         error "curl not found. Please install curl."
     fi
 
-    if ! curl_with_headers -#fL --max-time 300 -o "$_INSTALL_TMP_FILE" "$ARCUP_URL" ; then
+    if ! curl_with_headers -#fL --max-time 300 -o "$_INSTALL_TMP_FILE" "$ARCUP_URL" || [[ ! -s "$_INSTALL_TMP_FILE" ]]; then
         error "failed to download arcup from '$ARCUP_URL'"
     fi
 
diff --git a/arcup/test_install.sh b/arcup/test_install.sh
new file mode 100755
index 00000000..ae8e266c
--- /dev/null
+++ b/arcup/test_install.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TEST_TMP="$(mktemp -d)"
+export ARCUP_INSTALL_SKIP_MAIN=1
+export ARC_DIR="$TEST_TMP/arc"
+export ARC_BIN_DIR="$ARC_DIR/bin"
+
+# shellcheck source=install
+source "$SCRIPT_DIR/install"
+trap 'rm -rf "$TEST_TMP"' EXIT
+
+# curl 8.14.0/8.14.1 can print an HTTP error but return success when
+# --retry and --fail are combined. Reproduce that contract violation by
+# returning 0 without writing the requested output file.
+curl_with_headers() {
+    return 0
+}
+
+out="$TEST_TMP/install.out"
+if (main) >"$out" 2>&1; then
+    echo "FAIL: empty bootstrap download was accepted" >&2
+    cat "$out" >&2
+    exit 1
+fi
+
+if ! grep -q "failed to download arcup" "$out"; then
+    echo "FAIL: expected bootstrap download error was not reported" >&2
+    cat "$out" >&2
+    exit 1
+fi
+
+if [[ -e "$ARC_BIN_DIR/arcup" ]]; then
+    echo "FAIL: empty arcup executable was installed" >&2
+    exit 1
+fi
+
+echo "PASS: empty bootstrap download is rejected"