diff --git a/crates/plugin/src/manifest.rs b/crates/plugin/src/manifest.rs
index 6bca9aef2..269174e0f 100644
--- a/crates/plugin/src/manifest.rs
+++ b/crates/plugin/src/manifest.rs
@@ -77,6 +77,7 @@ fn api_from_number_or_string<'de, D: serde::Deserializer<'de>>(d: D) -> Result<u
             .trim()
             .split('.')
             .next()
+            .filter(|major| !major.is_empty() && major.bytes().all(|b| b.is_ascii_digit()))
             .and_then(|major| major.parse().ok())
             .ok_or_else(|| serde::de::Error::custom(format!("invalid api version `{s}`"))),
     }
diff --git a/crates/plugin/src/tests.rs b/crates/plugin/src/tests.rs
index 30311d802..3f5479081 100644
--- a/crates/plugin/src/tests.rs
+++ b/crates/plugin/src/tests.rs
@@ -472,3 +472,10 @@ fn api_may_be_a_version_string() {
     assert!(manifest(json!({"api": format!("{}.0.0", crate::API_VERSION + 1)})).is_err());
     assert!(manifest(json!({"api": "x"})).is_err());
 }
+
+#[test]
+fn api_version_string_rejects_signs() {
+    for bad in ["+2.0.0", "-1.0.0", "+2", ""] {
+        assert!(manifest(json!({"api": bad})).is_err(), "accepted {bad:?}");
+    }
+}