diff --git a/testing/baselines/tests.bundle-non-default-branch/foo.__load__.zeek b/testing/baselines/tests.bundle-non-default-branch/foo.__load__.zeek
new file mode 100644
index 0000000..8af7022
--- /dev/null
+++ b/testing/baselines/tests.bundle-non-default-branch/foo.__load__.zeek
@@ -0,0 +1,2 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+print "feature branch content";
diff --git a/testing/baselines/tests.bundle-non-default-branch/installed.out b/testing/baselines/tests.bundle-non-default-branch/installed.out
new file mode 100644
index 0000000..9b2d1fe
--- /dev/null
+++ b/testing/baselines/tests.bundle-non-default-branch/installed.out
@@ -0,0 +1,2 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+one/alice/foo (installed: feature-branch)
diff --git a/testing/tests/bundle-non-default-branch b/testing/tests/bundle-non-default-branch
new file mode 100644
index 0000000..3c80a5e
--- /dev/null
+++ b/testing/tests/bundle-non-default-branch
@@ -0,0 +1,40 @@
+# Regression test: bundle() must check out the requested non-default branch
+# when doing a fresh clone (i.e. when bundling via --manifest).
+#
+# Previously, git_clone() was called but git_checkout() was never called in
+# bundle(), so the working tree inside the bundle always reflected the remote
+# default branch HEAD regardless of the requested version.
+#
+# We test by inspecting the raw bundle archive contents, which is not affected
+# by the git_checkout() call in unbundle() -> _install().
+#
+# @TEST-EXEC: bash -euo pipefail %INPUT
+# @TEST-EXEC: cat manifest.ini
+# @TEST-EXEC: $TEST_BASE/../zkg --configfile=config bundle --force --manifest manifest.ini -- test.bundle
+# @TEST-EXEC: tar -tzf test.bundle
+# @TEST-EXEC: tar -xzf test.bundle foo/__load__.zeek
+# @TEST-EXEC: btest-diff foo/__load__.zeek
+
+# Create a non-default branch on foo with distinct content.
+# foo uses 'main' as default branch (see testing/scripts/initializer).
+cd packages/foo
+FOO_URL=$(pwd)
+echo 'print "main content";' > __load__.zeek
+git commit -am 'main content'
+
+git checkout -b feature-branch
+echo 'print "feature branch content";' > __load__.zeek
+git commit -am 'feature branch content'
+
+# Advance main past feature-branch so they are clearly distinct.
+git checkout main
+echo 'print "main advanced content";' > __load__.zeek
+git commit -am 'advance main'
+
+cd -
+
+# Write manifest INI referencing foo by local path and the non-default branch.
+cat > manifest.ini <<EOF
+[bundle]
+${FOO_URL} = feature-branch
+EOF
diff --git a/zeekpkg/manager.py b/zeekpkg/manager.py
index 1601a13..339b291 100644
--- a/zeekpkg/manager.py
+++ b/zeekpkg/manager.py
@@ -2507,10 +2507,16 @@ def match_package_url_and_version(
                     continue
 
             try:
-                git_clone(git_url, clonepath, shallow=(not is_sha1(version)))
+                clone = git_clone(git_url, clonepath, shallow=(not is_sha1(version)))
             except git.GitCommandError as error:
                 return f"failed to clone {git_url}: {error}"
 
+            if version and not is_sha1(version):
+                try:
+                    git_checkout(clone, version)
+                except git.GitCommandError as error:
+                    return f"failed to checkout {version} of {git_url}: {error}"
+
         # Record the built-in packages expected by this bundle (or simply
         # installed on the source system) in a new [meta] section to aid
         # debugging. This isn't interpreted, but if unbundle produces