diff --git a/images/fedora-intune/intune/defender-remediation.sh b/images/fedora-intune/intune/defender-remediation.sh
index 7f8c75c..403f542 100755
--- a/images/fedora-intune/intune/defender-remediation.sh
+++ b/images/fedora-intune/intune/defender-remediation.sh
@@ -71,8 +71,16 @@ if ! wait_for_daemon; then
 fi
 
 if [[ -z "$(field org_id)" ]]; then
-  if [[ "${ONBOARDING_JSON}" == REPLACE_WITH_MDATP_ONBOARD_JSON ]]; then
+  # Prefix match, so the placeholder appears only once in this file and a
+  # find-and-replace of it can't hit this line.
+  if [[ "${ONBOARDING_JSON}" == REPLACE_WITH_* ]]; then
     log "Defender is not onboarded and this script has no onboarding JSON."
+  elif ! printf '%s\n' "${ONBOARDING_JSON}" \
+      | python3 -c 'import json, sys; assert "onboardingInfo" in json.load(sys.stdin)' 2>/dev/null; then
+    # A paste that lost the first "{" or last "}" line would otherwise leave
+    # Defender with an unreadable onboarding file ("No license found").
+    log "The onboarding JSON in this script is not valid; paste mdatp_onboard.json again, including its first '{' and last '}' lines."
+    exit 1
   else
     log "Defender is not onboarded; writing ${ONBOARD_FILE}."
     install -d -m 0755 "$(dirname "${ONBOARD_FILE}")"