diff --git a/lib/handlers/git/manifest.js b/lib/handlers/git/manifest.js
index <HASH>..<HASH> 100644
--- a/lib/handlers/git/manifest.js
+++ b/lib/handlers/git/manifest.js
@@ -11,20 +11,27 @@ const semver = require('semver')
 module.exports = manifest
 function manifest (spec, opts) {
   opts = optCheck(opts)
-  if (spec.hosted) {
+  if (spec.hosted && spec.spec === spec.hosted.shortcut) {
     return hostedManifest(spec, opts)
   } else {
+    // If it's not a shortcut, don't do fallbacks.
     return plainManifest(spec.spec, spec, opts)
   }
 }
 
 function hostedManifest (spec, opts) {
-  return plainManifest(
-    spec.hosted.gitUrl, spec, opts
-  ).catch(() => {
-    return plainManifest(spec.hosted.sshUrl, spec, opts)
-  }).catch(() => {
+  return BB.resolve(null).then(() => {
     return plainManifest(spec.hosted.httpsUrl, spec, opts)
+  }).catch(err => {
+    if (!spec.hosted.ssh) {
+      throw err
+    }
+    return plainManifest(spec.hosted.ssh, spec, opts)
+  }).catch(err => {
+    if (!spec.hosted.gitUrl) {
+      throw err
+    }
+    return plainManifest(spec.hosted.gitUrl, spec, opts)
   })
 }
fix(git): fix fallback order and only fall back on hosted shortcuts