diff --git a/ziti-tunnel/docker/.gitignore b/ziti-tunnel/docker/.gitignore
index 8110798a9..0cf75dfd8 100644
--- a/ziti-tunnel/docker/.gitignore
+++ b/ziti-tunnel/docker/.gitignore
@@ -1,3 +1,6 @@
 # enrollments in-use with Docker Compose
 *.json
 *.jwt
+
+# executable from fetch bins script
+/ziti-tunnel
diff --git a/ziti-tunnel/docker/fetch-ziti-bins.sh b/ziti-tunnel/docker/fetch-ziti-bins.sh
index 8d879e92b..d99b3748e 100755
--- a/ziti-tunnel/docker/fetch-ziti-bins.sh
+++ b/ziti-tunnel/docker/fetch-ziti-bins.sh
@@ -1,16 +1,23 @@
-#!/bin/bash -eu
-set -o pipefail
+#!/bin/bash
 
-echo "Fetching from Artifactory."
-if [ -z "${ARTIFACTORY_BASE_URL}" ]; then ARTIFACTORY_BASE_URL="https://netfoundry.jfrog.io/netfoundry"; fi
-if [ -z "${ARTIFACTORY_REPO}" ]; then  ARTIFACTORY_REPO="ziti-release"; fi
+set -euo pipefail
+
+[[ $# -eq 0 ]] && {
+    echo "ERROR: need the base name(s) of the executable(s) to fetch e.g. \"ziti-tunnel ...\"." >&2
+    exit 1
+}
+
+: ${ARTIFACTORY_BASE_URL:="https://netfoundry.jfrog.io/netfoundry"}
+: ${ARTIFACTORY_REPO:="ziti-release"}
 for var in ARTIFACTORY_BASE_URL ARTIFACTORY_REPO ZITI_VERSION; do
-    if [ -z "${!var}" ]; then
+    if [ -z "${!var:-}" ]; then
         echo "ERROR: ${var} must be set when fetching binaries from Artifactory." >&2
         exit 1
     fi
 done
 
+echo "Fetching from Artifactory."
+
 # map host architecture/os to directories that we use in netfoundry.jfrog.io.
 # (our artifact directories seem to align with Docker's TARGETARCH and TARGETOS
 #  build arguments, which we could rely on if we fully committed to "docker buildx" - see