diff --git a/src/specify_cli/workflows/_commands.py b/src/specify_cli/workflows/_commands.py
index 2ef514643..c517bc620 100644
--- a/src/specify_cli/workflows/_commands.py
+++ b/src/specify_cli/workflows/_commands.py
@@ -713,8 +713,10 @@ def workflow_add(
 
     # Try as URL (http/https) — either the positional source is a URL, or an
     # explicit --from URL names where to fetch it (mirrors `extension add --from`).
-    download_url = from_url or (
-        source if source.startswith(("http://", "https://")) else None
+    download_url = (
+        from_url
+        if from_url is not None
+        else (source if source.startswith(("http://", "https://")) else None)
     )
     if download_url is not None:
         from ipaddress import ip_address
diff --git a/tests/test_workflows.py b/tests/test_workflows.py
index 2277db359..7554deb0d 100644
--- a/tests/test_workflows.py
+++ b/tests/test_workflows.py
@@ -7394,6 +7394,19 @@ steps:
         assert "does not match" in result.output
         assert not WorkflowRegistry(project_dir).is_installed("align-wf")
 
+    def test_add_from_empty_url_rejected_not_catalog_fallback(self, project_dir, monkeypatch):
+        """--from "" must fail URL validation, not silently install from the catalog."""
+        from typer.testing import CliRunner
+        from specify_cli import app
+        from specify_cli.workflows.catalog import WorkflowRegistry
+
+        monkeypatch.chdir(project_dir)
+        runner = CliRunner()
+        result = runner.invoke(app, ["workflow", "add", "align-wf", "--from", ""])
+        assert result.exit_code != 0
+        assert "HTTPS" in result.output
+        assert not WorkflowRegistry(project_dir).is_installed("align-wf")
+
     def test_add_from_url_non_https_redirect_escapes_rich_markup(self, project_dir, monkeypatch):
         """A redirect to a non-HTTPS IPv6 literal (legally bracketed) must not be parsed as Rich markup."""
         from unittest.mock import patch