diff --git a/src/release-branch-build-tools.js b/src/release-branch-build-tools.js
index 0bcb144..1c1c71c 100644
--- a/src/release-branch-build-tools.js
+++ b/src/release-branch-build-tools.js
@@ -25,8 +25,8 @@ async function getPackagesForBuildInstruction(instructions) {
 
 
   // use the latest tag in branch ref
-  const baseVersionsOnRef = await getLatestTag(repoUrl);
-  console.log(`Basing ${repoUrl} package versions on those from tag ${baseVersionsOnRef}`);
+  const baseVersionsOnRef = await getLatestTag(repoUrl) || instructions.ref || 'HEAD';
+  console.log(`Basing ${repoUrl} package versions on those from reference ${baseVersionsOnRef}`);
 
   for (const packageDir of (instructions.packageDirs || [])) {
     const {label, dir, excludes} = Object.assign({excludes: []}, packageDir);
diff --git a/src/repository/shell-git.js b/src/repository/shell-git.js
index 0b5025c..12bac87 100644
--- a/src/repository/shell-git.js
+++ b/src/repository/shell-git.js
@@ -55,14 +55,14 @@ function trimDir(dir) {
  * @param {String} ref
  */
 function validateRefIsSecure(ref) {
-  if (ref.substring(0, 1) === '-' || ref.includes(' ') || ref.includes('`') || ref.includes('$')) {
+  if (!ref || ref.substring(0, 1) === '-' || ref.includes(' ') || ref.includes('`') || ref.includes('$')) {
     throw new Error(`Rejecting the ref "${ref}" as potentially insecure`)
   }
   return ref;
 }
 
 function validateBranchIsSecure(branch) {
-  if (branch.substring(0, 1) === '-' || branch.includes(' ') || branch.includes('`') || branch.includes('$')) {
+  if (!branch || branch.substring(0, 1) === '-' || branch.includes(' ') || branch.includes('`') || branch.includes('$')) {
     throw new Error(`Rejecting the branch "${branch}" as potentially insecure`)
   }
   return branch;