diff --git a/src/apps.js b/src/apps.js
index 70b3b4f66..9e50a20df 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -458,8 +458,9 @@ function validateBackupFormat(format) {
 }
 
 function validateUpstreamUri(upstreamUri) {
-    if (upstreamUri === null) return null;
+    assert.strictEqual(typeof upstreamUri, 'string');
 
+    if (!upstreamUri) return null;
     if (upstreamUri.length > 256) return new BoxError(BoxError.BAD_FIELD, 'upstreamUri must be less than 256');
 
     return null;
@@ -1295,7 +1296,7 @@ async function install(data, auditSource) {
         overwriteDns = 'overwriteDns' in data ? data.overwriteDns : false,
         skipDnsSetup = 'skipDnsSetup' in data ? data.skipDnsSetup : false,
         appStoreId = data.appStoreId,
-        upstreamUri = data.upstreamUri,
+        upstreamUri = data.upstreamUri || '',
         manifest = data.manifest;
 
     let error = manifestFormat.parse(manifest);
@@ -1453,7 +1454,7 @@ async function setUpstreamUri(app, upstreamUri, auditSource) {
     assert.strictEqual(typeof auditSource, 'object');
 
     const appId = app.id;
-    let error = validateUpstreamUri(upstreamUri);
+    const error = validateUpstreamUri(upstreamUri);
     if (error) throw error;
 
     await reverseProxy.writeAppConfig(_.extend({}, app, { upstreamUri }));