diff --git a/src/servers/plugins/fetch.ts b/src/servers/plugins/fetch.ts
index 35713b6f..e91306a9 100644
--- a/src/servers/plugins/fetch.ts
+++ b/src/servers/plugins/fetch.ts
@@ -56,7 +56,14 @@ export async function fetchPlugin(appName: string, onLog?: OnLog): Promise<Fetch
   // The URL comes from the catalogue and reaches a command line, so it is checked rather than trusted.
   // Deliberately narrow: https only, no credentials in the URL, no shell metacharacters. A private
   // plugin needing auth is a separate feature and must not arrive by someone putting a token in here.
-  if (!/^https:\/\/[A-Za-z0-9._~\-/]+\.git$/.test(entry.source)) {
+  //
+  // `.git` is OPTIONAL, not required — Gitea and GitHub both clone identically with or without it, so
+  // requiring the suffix enforces a naming convention, not a security property. Found the hard way:
+  // music's own marketplace row was hand-entered as `.../plugins/music`, no suffix, and this regex
+  // refused a completely valid, credential-free, https clone URL with a message ("https URLs only, no
+  // credentials") that describes neither actual reason. Row fixed for consistency with its siblings, but
+  // the regex should never have depended on it.
+  if (!/^https:\/\/[A-Za-z0-9._~\-/]+(\.git)?$/.test(entry.source)) {
     return { ok: false, dir, error: `refusing to clone from "${entry.source}" — https URLs only, no credentials` };
   }